{"id":"GHSA-prf8-cf2x-rhx7","summary":"fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE","details":"## Summary\n\nThis advisory covers the deprecated `fabric-sdk-java` client SDK. `Channel.java` implements `readObject()` and exposes `deSerializeChannel()` which call `ObjectInputStream.readObject()` on untrusted byte arrays without configuring an `ObjectInputFilter`. This is the classic Java deserialization RCE pattern.\n\n**Note:** `fabric-sdk-java` is deprecated and maintained in https://github.com/hyperledger/fabric-sdk-java. Filing here as that repo does not have private vulnerability reporting enabled.\n\n## Affected Code\n\n```java\n// src/main/java/org/hyperledger/fabric/sdk/Channel.java\nprivate void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {\n    in.defaultReadObject();  // No ObjectInputFilter configured\n}\n\npublic Channel deSerializeChannel(byte[] channelBytes)\n        throws IOException, ClassNotFoundException, InvalidArgumentException {\n    ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(channelBytes));\n    Channel channel = (Channel) ois.readObject();  // Untrusted bytes deserialized\n    return channel;\n}\n```\n\n## Attack Vector\n\nAn attacker who can supply crafted serialized Channel bytes to the client application — for example, by compromising a local channel file, injecting data through an application that accepts Channel bytes from external sources, or exploiting a separate write primitive — can achieve RCE via gadget chain exploitation when deSerializeChannel() processes those bytes. The risk is highest in deployments that accept Channel data from sources outside the client's direct control. Note: channel data is not transmitted from Fabric peers; this is a client-side deserialization surface.\n\n## Proof of Concept\n\n```java\n// Generate malicious payload with ysoserial:\n// java -jar ysoserial.jar CommonsCollections6 \"touch /tmp/pwned\" \u003e malicious_channel.ser\n\n// Victim code:\nbyte[] maliciousBytes = Files.readAllBytes(Paths.get(\"malicious_channel.ser\"));\nChannel channel = client.deSerializeChannel(maliciousBytes);  // RCE fires here\n```\n\n## Notes on Deprecation\n\nfabric-sdk-java is deprecated as of Hyperledger Fabric v2.5 (replaced by `org.hyperledger.fabric:fabric-gateway`). However, organizations that have not yet migrated remain fully exposed. Automated dependency scanners (Snyk, Dependabot) cannot alert users without a published GHSA. This advisory is filed to ensure those users are notified and directed to migrate.\n\n## Fix\n\nFor the deprecated SDK: add `ObjectInputFilter` to whitelist only expected classes:\n\n```java\nObjectInputFilter filter = ObjectInputFilter.Config.createFilter(\n    \"org.hyperledger.fabric.sdk.*;java.util.*;java.lang.*;!*\"\n);\nois.setObjectInputFilter(filter);\n```\n\n**The recommended remediation is migration to `org.hyperledger.fabric:fabric-gateway`**, which does not use Java serialization.\n\n## Resources\n\n- CWE-502: Deserialization of Untrusted Data\n- Migration guide: https://hyperledger.github.io/fabric-gateway/\n\n## Credits\n\nFound by [Martin Brodeur (brodmart)](https://github.com/brodmart) via independent security research.","aliases":["BIT-hyperledger-fabric-orderer-2026-41586","BIT-hyperledger-fabric-peer-2026-41586","BIT-hyperledger-fabric-tools-2026-41586","CVE-2026-41586"],"modified":"2026-05-20T23:00:14.168816330Z","published":"2026-04-29T20:41:58Z","database_specific":{"github_reviewed_at":"2026-04-29T20:41:58Z","nvd_published_at":"2026-05-07T06:16:04Z","cwe_ids":["CWE-502"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41586"},{"type":"PACKAGE","url":"https://github.com/hyperledger/fabric-sdk-java"},{"type":"WEB","url":"https://hyperledger.github.io/fabric-gateway"}],"affected":[{"package":{"name":"org.hyperledger.fabric-sdk-java:fabric-sdk-java","ecosystem":"Maven","purl":"pkg:maven/org.hyperledger.fabric-sdk-java/fabric-sdk-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"2.2.26"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.1.0-alpha","1.2.0","1.2.1","1.2.2","1.3.0","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.23","2.2.24","2.2.25","2.2.26","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-prf8-cf2x-rhx7/GHSA-prf8-cf2x-rhx7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}