Read the docs
TI-2026-26080 Aliases CVE-2026-33701GHSA-xw7x-h9fj-p2c7

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

Priority MEDIUM 50CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00936 61st percentileScored 2026-11-07
Fix Fixed opentelemetry-java-instrumentation (open-telemetry): 2.26.1io.opentelemetry.javaagent:opentelemetry-javaagent (Maven): 2.26.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-java-instrumentationbefore 2.26.12.26.1Patch availableCNA
—io.opentelemetry.javaagent:opentelemetry-javaagent (Maven)before 2.26.12.26.1Patch availableGHSA-xw7x-h9fj-p2c7
  • opentelemetry-java-instrumentation Vendoropen-telemetry Affected before 2.26.1 Fixed in 2.26.1 Patch available CNA
  • io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) Vendor— Affected before 2.26.1 Fixed in 2.26.1 Patch available GHSA-xw7x-h9fj-p2c7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:*before 2.26.1Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:* Versions before 2.26.1 Vulnerable ·backstage

Remediation

  • Fix · CNA opentelemetry-java-instrumentation (open-telemetry) Fixed in 2.26.1
  • Fix · GHSA-xw7x-h9fj-p2c7 io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) Fixed in 2.26.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33701
  2. 2026-10-03 Alias added: GHSA-xw7x-h9fj-p2c7

References

Patch 1

Advisory 2

Other 5

  • TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
  • TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
  • TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
  • TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
  • TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
  • TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences