Threat database

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability in fabric-chaincode-java versions 2.3.1 up to but not including 2.5.10 causes the TLS private key password to be logged in plaintext at INFO level when chaincode is deployed in chaincode-as-a-service mode with TLS enabled. This exposure could allow an attacker with access to the logs to recover the password and potentially impersonate the chaincode server if they also obtain the TLS private key. The issue is fixed in version 2.5.10.

CVE-2026-41586 is a critical vulnerability in Hyperledger Fabric versions 1.0.0 through 2.2.26 involving unsafe deserialization of untrusted data. The vulnerability arises because Channel.java calls ObjectInputStream.readObject() on untrusted byte arrays without an ObjectInputFilter, leading to a classic Java deserialization remote code execution (RCE) pattern. No patches or official fixes are available at the time of publication. The vulnerability has a high CVSS 4.

Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the Ursa and AnonCreds implementations is that the Issuer does not publish a key correctness proof demonstrating that a generated private key is sufficient to meet the unlinkability guarantees of AnonCreds. The Ursa and AnonCreds CL-Signatures implementations always generate a sufficient private key. A malicious issuer could in theory create a custom CL Signature implementation (derived from the Ursa or AnonCreds CL-Signatures implementations) that uses weakened private keys such that presentations from holders could be shared by verifiers to the issuer who could determine the holder to which the credential was issued. This vulnerability could impact holders of AnonCreds credentials implemented using the CL-signature scheme in the Ursa and AnonCreds implementations of CL Signatures. The ursa project has has moved to end-of-life status and no fix is expected.

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.