CVE-2026-41586: fabric-sdk-java ObjectInputStream deserialization without filter allows RCE

Overview

CVE-2026-41586 is a deserialization weakness in Java code related to Hyperledger Fabric. According to the record, Channel.java implements readObject() and exposes deSerializeChannel(), which pass untrusted byte arrays to ObjectInputStream.readObject() without configuring an ObjectInputFilter. The record classifies the issue under CWE-502.

Impact

• The record describes the pattern as a classic Java deserialization remote code execution (RCE) issue.
• The NVD vector lists network attack vector, no privileges required, no user interaction, and high confidentiality, integrity and availability impact, with a base score of 9.8.
• GitHub scores the same issue at 9.3 under a newer CVSS scheme.
• The SSVC fields in the record mark the issue as automatable and with total technical impact.

Affected products and versions

• Product named in the record: Hyperledger Fabric.
• Affected range: from 1.0.0 up to and including 2.2.26.
• The record title refers to fabric-sdk-java, while the affected product field names Hyperledger Fabric. The exact relationship between these packages should be confirmed in the vendor advisory.
• The record does not state a fixed version. Its only remediation-type entry is a mitigation reference.

Exploitation status

• The record shows the CVE is not listed in CISA KEV, so active exploitation is not confirmed.
• No confirmed exploitation appears in the sources consulted.
• The SSVC exploitation field is recorded as poc, which should be read as a signal of proof-of-concept maturity rather than evidence of attacks.
• One reference is tagged as Exploit in the record. Its content was not available for this analysis.

Remediation and mitigation

• Inventory all deployments that use Hyperledger Fabric code within the stated range.
• Because no patch was publicly available at publication, follow the mitigation guidance in the GitHub Security Advisory.
• Restrict which parties can supply data that reaches the deserialization path, and isolate components that process channel data from untrusted sources.
• Upgrade once a fixed version is published and verify it against the vendor advisory.

Detection guidance

• Review logs and network telemetry for components that handle channel data, looking for unexpected serialized input or deserialization errors.
• Monitor Fabric-related Java services for unexpected child processes or outbound connections.
• Treat unexplained process activity on those hosts as a priority for investigation.

Limitations of the available information

• The record does not state fixed versions.
• The record does not include the full text of the mitigation guidance.
• The EPSS probability is 0.00631 with percentile 0.49637, dated 2026-10-23 in the record. This is a model estimate and not evidence of confirmed exploitation.
• The record does not describe how untrusted data reaches the affected code path, so exposure in a given deployment cannot be determined from it.

Sources: NVD entry and CVE Record.

Frequently asked questions

Which Hyperledger Fabric versions are affected by CVE-2026-41586?

The record states the range is from 1.0.0 up to and including 2.2.26. The record does not state a fixed version.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV in the record, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted.

What should administrators do now?

Inventory affected deployments, follow the mitigation guidance in the linked GitHub Security Advisory, restrict untrusted data reaching the deserialization path, and upgrade once a verified fixed version is published.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.