CVE-2026-54704: medium-severity vulnerability in open-telemetry opentelemetry-java-instrumentati…
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
Published · Updated
Follow this CVE+ Monitor opentelemetry-java-instrumentation+ Monitor io.opentelemetry.javaagent:opentelemetry-javaagent
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.4%
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
open-telemetry · opentelemetry-java-instrumentationRelated CVEs — open-telemetry opentelemetry-java-instrumentati…
In the same product, most dangerous first.
CVE-2026-33701CRITICALOpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code ExecutionEPSS 0.9%CVE-2023-39951MEDIUMInstrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backendEPSS 0.8%CVE-2026-54712MEDIUMOpenTelemetry Javaagent RMI context propagation allows resource exhaustionEPSS 0.5%