CVE-2026-41586

The Channel.java class implements the readObject() method and provides the deSerializeChannel() method, which calls ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter mechanism. The lack of deserialization input filtering allows an attacker to deliver a crafted Java object (so-called gadget chain), leading to arbitrary code execution on the server. This is a classic RCE attack pattern through Java deserialization, known and widely documented in the JVM ecosystem.

An unauthenticated remote attacker can achieve remote code execution (RCE) on a Hyperledger Fabric node, which in practice means full compromise of the blockchain network node, ability to read and modify data, and potential lateral movement within the infrastructure.

At the time of vulnerability publication, no publicly available patches are available. Monitor the vendor's repository at https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 and apply the patch immediately upon release. As interim remedial measures, it is recommended to restrict network access to Hyperledger Fabric nodes only from trusted hosts (e.g., using firewall/ACL) and to implement enhanced monitoring of network traffic on Fabric service ports.

Hyperledger Fabric versions 1.0.0 through 2.2.26 (inclusive)