CVE-2026-54704: fallo de gravedad media en open-telemetry opentelemetry-java-instrumentati…
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear opentelemetry-java-instrumentation+ Monitorear io.opentelemetry.javaagent:opentelemetry-javaagent
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
open-telemetry · opentelemetry-java-instrumentationCVEs relacionadas — open-telemetry opentelemetry-java-instrumentati…
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-33701CRITICALOpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code ExecutionEPSS 0.9%CVE-2023-39951MEDIUMInstrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backendEPSS 0.8%CVE-2026-54712MEDIUMOpenTelemetry Javaagent RMI context propagation allows resource exhaustionEPSS 0.5%