Answer in brief
CVE-2026-45581 records a Medium severity security vulnerability in fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-45581 records a Medium severity security vulnerability in fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim to 2.5.10 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-45581 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| org.hyperledger.fabric-chaincode-java:fabric-chaincode-shimmaven | >=2.3.1,<=2.5.9 | 2.5.10 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-45581 records a Medium severity security vulnerability in fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim to 2.5.10 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-45581 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| org.hyperledger.fabric-chaincode-java:fabric-chaincode-shimmaven | >=2.3.1,<=2.5.9 | 2.5.10 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-45581 records a Medium severity security vulnerability in fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardWhen chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover the TLS private key password. If the attacker can also obtain the TLS private key, they could impersonate the chaincode server. ### Recommendation - Update to the fixed version of the chaincode runtime. - Redact or remove existing logs that contain the TLS private key password. - Change the TLS private key password. ### Mitigation Impacted deployments can mitigate the vulnerability by restricting the logging level to WARNING or higher so that INFO level logs are not written.
When chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover the TLS private key password. If the attacker can also obtain the TLS private key, they could impersonate the chaincode server. ### Recommendation - Update to the fixed version of the chaincode runtime. - Redact or remove existing logs that contain the TLS private key password. - Change the TLS private key password. ### Mitigation Impacted deployments can mitigate the vulnerability by restricting the logging level to WARNING or higher so that INFO level logs are not written.