CVE-2026-33701
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A vulnerability in OpenTelemetry Java Instrumentation prior to 2.26.1 allows remote code execution (RCE) via deserialization of untrusted data in the RMI registration. The attack requires JDK 16 or earlier, an explicitly configured JMX/RMI port, and a gadget-chain library on the classpath.
Risk Assessment
The organization risks full compromise of the Java application with the user's privileges, potentially leading to data theft, backdoor installation, or system disruption.
Recommendation
Immediately upgrade OpenTelemetry Java Instrumentation to version 2.26.1 or later. For JDK < 17, apply the workaround by setting the system property `-Dotel.instrumentation.rmi.enabled=false`.
Original NVD description (English source)
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.