Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 7, 2026 · NIST NVD

   Detected

   Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of

2. Aug 25, 2026 · NIST NVD

   Updated

   Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of

Affected

• cpe hyperledger/fabricversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-41586

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-41586

  Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrust

  nvd.nist.gov

References

• Exploit · github.com
• Product · hyperledger.github.io