Threats affecting pkg:maven/io.opentelemetry/opentelemetry-java-instrumentation

CVE-2026-54712 is a medium severity vulnerability in OpenTelemetry Java Instrumentation versions prior to 2.27.0. It involves uncontrolled resource consumption due to the RMI context propagation payload reader not limiting the aggregate size of strings read from the stream. An attacker able to reach an RMI endpoint on an instrumented JVM with RMI instrumentation enabled can send an oversized payload, causing excessive memory allocation and potential denial of service. This issue is fixed in version 2.27.0.

OpenTelemetry Java Instrumentation versions prior to 2.28.0 contain a vulnerability where the JDBC auto-instrumentation fails to sanitize passwords in SQL CONNECT statements if the password is double-quoted. This results in clear-text database passwords being included in trace span attributes and potentially exported to observability backends. The issue is fixed in version 2.28.0.

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.