CVE-2026-33701
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A vulnerability in OpenTelemetry Java Instrumentation prior to 2.26.1 allows remote code execution (RCE) via deserialization of untrusted data in the RMI registration. The attack requires JDK 16 or earlier, an explicitly configured JMX/RMI port, and a gadget-chain library on the classpath.
Risk Assessment
The organization risks full compromise of the Java application with the user's privileges, potentially leading to data theft, backdoor installation, or system disruption.
Recommendation
Immediately upgrade OpenTelemetry Java Instrumentation to version 2.26.1 or later. For JDK < 17, apply the workaround by setting the system property `-Dotel.instrumentation.rmi.enabled=false`.
Other vulnerabilities in OpenTelemetry Java Instrumentation
See all- CVE-2026-54712Medium
A vulnerability in OpenTelemetry Java Instrumentation before version 2.27.0 allows an attacker to send an oversized RMI context propagation payload, causing excessive memory allocation and potential denial of service (DoS). This issue affects only deployments with RMI instrumentation enabled and a network-reachable RMI endpoint.
- CVE-2026-54704Medium
A vulnerability in OpenTelemetry Java Instrumentation prior to version 2.28.0 causes JDBC auto-instrumentation to fail sanitizing passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.
- CVE-2023-39951Medium
OpenTelemetry Java Instrumentation prior to version 1.28.0 has an issue related to the instrumentation of Java applications using AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When instrumenting POST requests to SES, query parameters are inserted into the `url.path` field, leading to the email content being present in telemetry metadata.
Original NVD description (English source)
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS