CVE-2026-54704
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in OpenTelemetry Java Instrumentation prior to version 2.28.0 causes JDBC auto-instrumentation to fail sanitizing passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.
Risk Assessment
The risk involves exposure of database passwords in plain text to external monitoring systems, potentially leading to unauthorized data access.
Recommendation
Immediately upgrade OpenTelemetry Java Instrumentation to version 2.28.0 or later, which includes a fix for this issue.
Other vulnerabilities in OpenTelemetry Java Instrumentation
See all- CVE-2026-33701Critical
A vulnerability in OpenTelemetry Java Instrumentation prior to 2.26.1 allows remote code execution (RCE) via deserialization of untrusted data in the RMI registration. The attack requires JDK 16 or earlier, an explicitly configured JMX/RMI port, and a gadget-chain library on the classpath.
- CVE-2026-54712Medium
A vulnerability in OpenTelemetry Java Instrumentation before version 2.27.0 allows an attacker to send an oversized RMI context propagation payload, causing excessive memory allocation and potential denial of service (DoS). This issue affects only deployments with RMI instrumentation enabled and a network-reachable RMI endpoint.
- CVE-2023-39951Medium
OpenTelemetry Java Instrumentation prior to version 1.28.0 has an issue related to the instrumentation of Java applications using AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When instrumenting POST requests to SES, query parameters are inserted into the `url.path` field, leading to the email content being present in telemetry metadata.
Original NVD description (English source)
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.