OpenTelemetry Java Instrumentation prior to version 2.26.1 registers a custom RMI endpoint that deserializes incoming data without applying serialization filters, leading to a CWE-502 deserialization of untrusted data vulnerability. This can be exploited on Java 16 and earlier if the JVM is instrumented with OpenTelemetry as a Java agent, a JMX/RMI port is explicitly configured and network-accessible, and a gadget-chain-compatible library is present on the classpath. Successful exploitation results in arbitrary remote code execution with the privileges of the JVM process. The vulnerability does not affect Java 17 and later. Mitigation includes upgrading to version 2.26.1 or later or disabling the RMI instrumentation via the system property `-Dotel.instrumentation.rmi.enabled=false`.

An attacker with network access to a configured JMX/RMI port on an instrumented JVM running Java 16 or earlier can achieve remote code execution with the privileges of the JVM process. This can lead to full compromise of the affected system. The vulnerability requires specific conditions to be met, including the presence of a gadget-chain-compatible library on the classpath. There are no known exploits in the wild at this time.

A fix is available by upgrading OpenTelemetry Java Instrumentation to version 2.26.1 or later. For environments running Java 17 or later, no action is required, though upgrading is recommended. As a temporary workaround for affected versions on Java 16 or earlier, disable the RMI integration by setting the system property `-Dotel.instrumentation.rmi.enabled=false`. This disables the vulnerable RMI endpoint and mitigates the risk.