GitHub Advisoryadvisory · Maven

GHSA-wg5x-3g47-v38r fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

MEDIUM Published 2026-05-19 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-45581
Ecosystem
Maven
Packages
org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2026-05-19

Affected packages

• Maven org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim: >= 2.3.1, < 2.5.10 → fixed in 2.5.10

Description

When chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover the TLS private key password. If the attacker can also obtain the TLS private key, they could impersonate the chaincode server. Recommendation • Update to the fixed version of the chaincode runtime. • Redact or remove existing logs that contain the TLS private key password. • Change the TLS private key password. Mitigation Impacted deployments can mitigate the vulnerability by restricting the logging level to WARNING or higher so that INFO level logs are not written.

Related

Alias · CVE (1)

  • CVE-2026-45581 fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References