CVE-2026-54704
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
In OpenTelemetry Java Instrumentation prior to version 2.28.0, a vulnerability in JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.
Risk Assessment
The organization risks exposure of database passwords in clear text to monitoring systems, potentially leading to unauthorized data access and security breaches.
Recommendation
Immediately update OpenTelemetry Java Instrumentation to version 2.28.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.