{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"1.0.0","last_affected":"2.2.26"}],"component":"org.hyperledger.fabric-sdk-java:fabric-sdk-java","cve_ids":["CVE-2026-41586"],"ecosystem":"Maven","epss":0.0053,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-prf8-cf2x-rhx7","id":"tcs_01M5N97Z74729R7ZQ7NQZFWQWY","modified_at":"2026-05-20T23:00:14.168816330Z","published_at":"2026-04-29T20:41:58Z","references":["https://osv.dev/vulnerability/GHSA-prf8-cf2x-rhx7","https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7","https://nvd.nist.gov/vuln/detail/CVE-2026-41586","https://github.com/hyperledger/fabric-sdk-java","https://hyperledger.github.io/fabric-gateway"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-prf8-cf2x-rhx7","url":"https://osv.dev/vulnerability/GHSA-prf8-cf2x-rhx7"},{"source":"nvd","source_id":"CVE-2026-41586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41586"}],"summary":"fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE"}