CVE-2026-45581: CWE-532: Insertion of Sensitive Information into Log File in hyperledger fabric-chaincode-java
A vulnerability in fabric-chaincode-java versions 2.3.1 up to but not including 2.5.10 causes the TLS private key password to be logged in plaintext at INFO level when chaincode is deployed in chaincode-as-a-service mode with TLS enabled. This exposure could allow an attacker with access to the logs to recover the password and potentially impersonate the chaincode server if they also obtain the TLS private key. The issue is fixed in version 2.5.10.
AI Analysis
Technical Summary
CVE-2026-45581 is a CWE-532 vulnerability affecting fabric-chaincode-java, a Java implementation of Hyperledger Fabric chaincode shim APIs. In versions from 2.3.1 to before 2.5.10, when running chaincode in chaincode-as-a-service mode with TLS enabled, the server logs at INFO level include the TLS private key password in plaintext. An attacker with access to these logs could extract the password. If the attacker also obtains the TLS private key, they could impersonate the chaincode server. The vulnerability is resolved in version 2.5.10.
Potential Impact
Exposure of the TLS private key password in logs can lead to compromise of the TLS private key if the attacker obtains it, enabling impersonation of the chaincode server. The confidentiality of the TLS private key password is directly impacted. There is no impact on integrity or availability indicated.
Mitigation Recommendations
Upgrade fabric-chaincode-java to version 2.5.10 or later, where this issue has been patched. Until upgrading, restrict access to chaincode server logs to trusted personnel only to prevent leakage of the TLS private key password.
CVE-2026-45581: CWE-532: Insertion of Sensitive Information into Log File in hyperledger fabric-chaincode-java
Description
A vulnerability in fabric-chaincode-java versions 2.3.1 up to but not including 2.5.10 causes the TLS private key password to be logged in plaintext at INFO level when chaincode is deployed in chaincode-as-a-service mode with TLS enabled. This exposure could allow an attacker with access to the logs to recover the password and potentially impersonate the chaincode server if they also obtain the TLS private key. The issue is fixed in version 2.5.10.
CVSS v3.1
Score 5.5medium
Affected software
pkg:maven/org.hyperledger/fabric-chaincode-java/fabric-chaincode-javaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-45581 is a CWE-532 vulnerability affecting fabric-chaincode-java, a Java implementation of Hyperledger Fabric chaincode shim APIs. In versions from 2.3.1 to before 2.5.10, when running chaincode in chaincode-as-a-service mode with TLS enabled, the server logs at INFO level include the TLS private key password in plaintext. An attacker with access to these logs could extract the password. If the attacker also obtains the TLS private key, they could impersonate the chaincode server. The vulnerability is resolved in version 2.5.10.
Potential Impact
Exposure of the TLS private key password in logs can lead to compromise of the TLS private key if the attacker obtains it, enabling impersonation of the chaincode server. The confidentiality of the TLS private key password is directly impacted. There is no impact on integrity or availability indicated.
Mitigation Recommendations
Upgrade fabric-chaincode-java to version 2.5.10 or later, where this issue has been patched. Until upgrading, restrict access to chaincode server logs to trusted personnel only to prevent leakage of the TLS private key password.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-12T19:00:14.601Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a26f68ee29bf47b50440d4f
Added to database: 06/08/2026, 17:06:22 UTC
Last enriched: 06/16/2026, 08:33:10 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.