OpenTelemetry Java Instrumentation prior to version 2.26.1 contains a deserialization of untrusted data vulnerability (CWE-502) in its RMI instrumentation. This vulnerability occurs because the RMI instrumentation registers a custom endpoint that deserializes incoming data without applying serialization filters on JDK 16 and earlier. Exploitation requires three conditions: the instrumentation is attached as a Java agent on Java 16 or earlier, a JMX/RMI port is explicitly configured and network-reachable, and a gadget-chain-compatible library is present on the classpath. Successful exploitation can lead to arbitrary remote code execution with the privileges of the JVM process user. For JDK 17 and above, the vulnerability does not apply. The vendor recommends upgrading to version 2.26.1 or later for JDK versions below 17 or disabling the RMI integration by setting the system property -Dotel.instrumentation.rmi.enabled=false as a workaround.

An attacker with network access to a configured JMX or RMI port on an instrumented JVM running OpenTelemetry Java Instrumentation versions prior to 2.26.1 on JDK 16 or earlier can achieve remote code execution with the privileges of the JVM process user. This can lead to full compromise of the affected system. The vulnerability does not affect JDK 17 or later.

For JDK 17 and later, no action is required, though upgrading is recommended. For JDK versions earlier than 17, upgrade OpenTelemetry Java Instrumentation to version 2.26.1 or later to address this vulnerability. As a temporary workaround, disable the RMI integration by setting the system property -Dotel.instrumentation.rmi.enabled=false. This disables the vulnerable RMI endpoint and mitigates the risk until an upgrade can be applied.