OpenTelemetry Java Instrumentation prior to version 2.26.1 registers a custom RMI endpoint that deserializes incoming data without applying serialization filters, leading to a CWE-502 deserialization of untrusted data vulnerability. On JVMs running JDK 16 or earlier, an attacker with network access to a configured JMX or RMI port can exploit this flaw to achieve remote code execution if a gadget-chain-compatible library is present on the classpath. Exploitation requires three conditions: the Java agent is attached, the JMX/RMI port is network-reachable, and the gadget chain is available. The vulnerability allows arbitrary code execution with the privileges of the JVM process. JDK 17 and later are not affected. The vendor recommends upgrading to version 2.26.1 or later or disabling the RMI instrumentation integration as a workaround. Red Hat's advisory confirms the vulnerability and notes that no complete mitigation meeting their criteria is currently available beyond upgrading or disabling the feature.

An attacker with network access to a configured JMX or RMI port on an instrumented JVM running JDK 16 or earlier can execute arbitrary code remotely with the privileges of the JVM process. This can lead to full compromise of the affected system. The vulnerability requires no user interaction or privileges and has a network attack vector, making it critical in severity. JDK 17 and later are not vulnerable.

Upgrade OpenTelemetry Java Instrumentation to version 2.26.1 or later. If upgrading is not immediately possible and the JVM runs JDK 16 or earlier, disable the RMI instrumentation by setting the system property '-Dotel.instrumentation.rmi.enabled=false'. For JDK 17 and later, no action is required but upgrading is recommended. Red Hat notes that no other mitigations meeting their criteria are currently available.