CVE-2026-41586
ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
EPSS 0.41%
Description
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.
How to fix CVE-2026-41586
To remediate CVE-2026-41586, upgrade the affected package to a fixed version below.
- —upgrade to 2.5.9 or later
- —upgrade to 2.5.9 or later
- —upgrade to 2.5.9 or later
- —no fix listed
Is CVE-2026-41586 being exploited?
Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.
Affected packages (4)
- >= 1.0.0, < 2.5.9
- >= 1.0.0, < 2.5.9
- >= 1.0.0, < 2.5.9
- >= 1.0.0, <= 2.2.26
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |