Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a result of sensitive information being logged. The advisory points to the TLS private key password being disclosed in INFO level logs. By comparing the last vulnerable version (v2.5.9) with the first patched version (v2.5.10), I identified commit 46fa6f9f6be5a3b00500eceb07adf26d8edfe758. This commit's message, "Exclude TLS key password from chaincode server log", directly addresses the issue. The code change is in the constructor of the NettyGrpcServer class, where the line LOGGER.info("KeyPassword:" + chaincodeServerProperties.getKeyPassword()); is removed. This confirms that the constructor org.hyperledger.fabric.shim.NettyGrpcServer.NettyGrpcServer is the function responsible for logging the sensitive data and is therefore the vulnerable function.
org.hyperledger.fabric.shim.NettyGrpcServer.NettyGrpcServerfabric-chaincode-shim/src/main/java/org/hyperledger/fabric/shim/NettyGrpcServer.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim | maven | >= 2.3.1, <= 2.5.9 | 2.5.10 |