9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41586

CVE-2026-41586: ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41586

CVE-2026-41586:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.hyperledger.fabric-sdk-java:fabric-sdk-java	maven	>= 1.0.0, <= 2.2.26

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Java Deserialization Remote Code Execution (RCE) in the fabric-sdk-java library. The root cause is the unsafe deserialization of Channel objects from a byte stream without proper validation.

The attack starts when an application uses the org.hyperledger.fabric.sdk.HFClient.deSerializeChannel method to deserialize a Channel object from a byte array. This method is the public entry point for the vulnerability. It creates an ObjectInputStream from the provided bytes and calls readObject().

This triggers the readObject method within the org.hyperledger.fabric.sdk.Channel class itself. This method directly calls in.defaultReadObject() without configuring an ObjectInputFilter to restrict which classes can be deserialized. An attacker can therefore provide a crafted byte array containing a serialized object with a malicious gadget chain. When readObject() is called, the Java Virtual Machine (JVM) will deserialize the object, executing the gadget chain and leading to RCE on the client application's host.

The vulnerability advisory correctly identifies the vulnerable code pattern, although it mistakenly places the deSerializeChannel method in Channel.java when it is actually located in HFClient.java. The provided proof-of-concept, client.deSerializeChannel(maliciousBytes), confirms that HFClient is the correct class for the entry point.

Vulnerable functions

org.hyperledger.fabric.sdk.HFClient.deSerializeChannel

src/main/java/org/hyperledger/fabric/sdk/HFClient.java

This public method is the primary entry point for the vulnerability. It takes a byte array, which can be controlled by an attacker, and deserializes it into a 'Channel' object using 'ObjectInputStream.readObject()' without any security filtering. This allows for the execution of arbitrary code if a malicious gadget chain is present in the serialized data.

org.hyperledger.fabric.sdk.Channel.readObject

src/main/java/org/hyperledger/fabric/sdk/Channel.java

This method is part of Java's serialization mechanism and is automatically called when a 'Channel' object is being deserialized. The vulnerability lies in its implementation, which calls 'in.defaultReadObject()' without first setting an 'ObjectInputFilter' on the stream. This allows the deserialization of potentially malicious objects (gadgets) that can lead to Remote Code Execution. This method is invoked by 'HFClient.deSerializeChannel'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.