Vulnerability · Published Jun 8, 2026 · Assigned by GitHub_M
CVE-2026-45581fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode
Medium 5.5
In plain English
A medium-severity sensitive data in logs in fabric-chaincode-java from hyperledger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover the TLS private key password. If the attacker can also obtain the TLS private key, they could impersonate the chaincode server. This issue has been patched in version 2.5.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim | 2.5.10 | GHSA-wg5x-3g47-v38r |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hyperledger | fabric-chaincode-java | >= 2.3.1, < 2.5.10 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N