fabric-chaincode-java versions from 2.3.1 up to before 2.5.10 log the TLS private key password in plain text when deployed in chaincode-as-a-service mode with TLS enabled. An attacker who can read the chaincode server logs can recover the password. If the attacker also obtains the TLS private key, they can impersonate the chaincode server and potentially interfere with the ledger or transaction processing.

The affected product is hyperledger fabric-chaincode-java, a Java implementation of Hyperledger Fabric chaincode shim APIs. Vulnerable releases include all versions from 2.3.1 through 2.5.9; the issue is fixed in version 2.5.10 and later.

The CVSS score of 5.5 indicates moderate risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an attacker with access to the chaincode logs, such as a user or a compromised system, who could capture the password. If the attacker also locates the TLS private key file, they can impersonate the chaincode server, undermining authentication and potentially allowing unauthorized transaction submission or data manipulation.