Executive brief
Hyperledger Fabric chaincode-java is a library used to develop smart contracts for the Hyperledger Fabric blockchain platform. A security flaw in certain versions causes the system to record sensitive TLS private key passwords in plain text within standard activity logs. If an unauthorized person gains access to these logs and the associated key files, they could impersonate the server, potentially compromising the security and integrity of the blockchain network.
Technical details
A sensitive information disclosure vulnerability (CWE-532) exists in fabric-chaincode-java when deployed in 'chaincode-as-a-service' mode with TLS enabled. The chaincode shim's logging mechanism incorrectly includes the TLS private key password in plaintext at the INFO logging level. An attacker with local access and low privileges who can read the server logs can recover this password. If the attacker also obtains the corresponding TLS private key, they can successfully impersonate the chaincode server. This issue is fixed in version 2.5.10; users are advised to upgrade, rotate passwords, and purge existing logs.
Affected products
- Hyperledger fabric-chaincode-java >= 2.3.1, < 2.5.10
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-08: disclosed: CVE published to NVD