CVE-2026-41586

critical · 9.3

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

9.3

CVSS

0.5%

EPSS (exploit prob.)

44th

EPSS percentile

2026-05-07

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
hyperledger	fabric	>= 1.0.0, <= 2.2.26

Check a specific version with /api/v1/cve/match.

References

https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7
https://hyperledger.github.io/fabric-gateway
https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-41586