HLF_TxTime_spoofing

HLFTxTimespoofing HLFTxTimespoofing - a PoC covering the problem of transaction time manipulation using GetTxTimestamp or GetHistoryForKey in the Hyperledger Fabric blockchain. Tested on v 2.5.5 and v3.0.0-beta The project consists of several parts: 1. timeinsecure - vulnerable chaincode variant...

hlf-time-oracle

hlf-time-oracle hlf-time-oracle è un chaincode per la blockchain Hyperledger Fabric che fornisce l'ora esatta ad altri chaincode. hlf-time-oracle si basa sul pacchetto ntp e sul pacchetto nts. Risolve così il problema di sicurezza associato alla possibile manipolazione del tempo di transazione da...

CVE-2026-45581

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the INFO level logging when chaincode is deployed in chaincode-as-a-service mode with TLS enabled. An attacker can obtain sensitive information TLS private key by accessing the server...

org.devocative.thallo:thallo-starter-fabric-chaincode (1.0) potentially affected by CVE-2026-45581 via org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (2.4.1)

org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim and may be impacted: -...

CVE-2026-45581

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

CVE-2026-45581 fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

CVE-2026-45581

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

EUVD-2026-35139

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

CVE-2026-45581 fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

CVE-2026-45581

CVE-2026-45581 affects fabric-chaincode-java (Hyperledger Fabric chaincode runtime). In versions 2.3.1 through 2.5.09, when deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server’s INFO logs include the TLS private key password in plaintext, enabling an attacker with log a...

org.devocative.thallo:thallo-starter-fabric-chaincode (1.0) potentially affected by CVE-2026-45581 via org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (2.4.1)

org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim and may be impacted: -...

CVE-2026-45581 fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

CVE-2026-45581

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

Hyperledger Fabric Chaincode Java log information leakage vulnerability

Hyperledger Fabric Chaincode Java is an open-source Java-based smart contract development framework developed by the Hyperledger project. In versions 2.3.1 to 2.5.10 of Hyperledger Fabric Chaincode Java, there was a vulnerability involving log information leakage. This vulnerability occurred when...

CVE-2026-45581: Insertion of Sensitive Information into Log File

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

org.devocative.thallo:thallo-starter-fabric-chaincode (1.0) potentially affected by CVE-2026-45581 via org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (2.4.1)

org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim and may be impacted: -...

org.devocative.thallo:thallo-starter-fabric-chaincode (1.0) potentially affected by CVE-2026-45581 via org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (2.4.1)

org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim and may be impacted: -...

GHSA-WG5X-3G47-V38R fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

When chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover the TLS private key password. If the attacker can also obtain...

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

When chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover the TLS private key password. If the attacker can also obtain...