Read the docs
TI-2026-33330 Aliases CVE-2026-45581GHSA-wg5x-3g47-v38r

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover the TLS private key password. If the attacker can also obtain the TLS private key, they could impersonate the chaincode server. This issue has been patched in version 2.5.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00106 1st percentileScored 2026-11-07
Fix Fixed fabric-chaincode-java (hyperledger): 2.5.10org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (Maven): 2.5.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hyperledgerfabric-chaincode-java2.3.1 to before 2.5.102.5.10Patch availableCNA
—org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (Maven)2.3.1 to before 2.5.102.5.10Patch availableGHSA-wg5x-3g47-v38r
  • fabric-chaincode-java Vendorhyperledger Affected 2.3.1 to before 2.5.10 Fixed in 2.5.10 Patch available CNA
  • org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (Maven) Vendor— Affected 2.3.1 to before 2.5.10 Fixed in 2.5.10 Patch available GHSA-wg5x-3g47-v38r

Remediation

  • Fix · CNA fabric-chaincode-java (hyperledger) Fixed in 2.5.10
  • Fix · GHSA-wg5x-3g47-v38r org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (Maven) Fixed in 2.5.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45581
  2. 2026-10-03 Alias added: GHSA-wg5x-3g47-v38r

References

Advisory 1

Other 2

  • TI-2026-30139 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE CVSS 4.0CRITICAL 9.3
  • TI-2024-14390 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC CVSS 3.1CRITICAL 9.9
  • TI-2022-13066 Unlinkability broken in ursa when verifiers use malicious keys CVSS 3.1MEDIUM 5.3
  • TI-2022-16450 Incorrect Conversion between Numeric Types in Besu Ethereum Client CVSS 3.1CRITICAL 9.1
  • TI-2022-13065 Remote code execution in Indy's NODE_UPGRADE transaction CVSS 3.1HIGH 8.8
  • TI-2025-21486 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve CVSS 4.0HIGH 8.7
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences