Read the docs
TI-2026-39520 Aliases CVE-2026-54704GHSA-rwqx-fvqh-6wm4

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

Priority LOW 29CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed opentelemetry-java-instrumentation (open-telemetry): 2.28.0io.opentelemetry.javaagent:opentelemetry-javaagent (Maven): 2.28.0-alpha

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-java-instrumentationbefore 2.28.02.28.0Patch availableCNA
—io.opentelemetry.javaagent:opentelemetry-javaagent (Maven)before 2.28.0-alpha2.28.0-alphaPatch availableGHSA-rwqx-fvqh-6wm4
  • opentelemetry-java-instrumentation Vendoropen-telemetry Affected before 2.28.0 Fixed in 2.28.0 Patch available CNA
  • io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) Vendor— Affected before 2.28.0-alpha Fixed in 2.28.0-alpha Patch available GHSA-rwqx-fvqh-6wm4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:*before 2.28.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:* Versions before 2.28.0 Vulnerable ·backstage

Remediation

  • Fix · CNA opentelemetry-java-instrumentation (open-telemetry) Fixed in 2.28.0
  • Fix · GHSA-rwqx-fvqh-6wm4 io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) Fixed in 2.28.0-alpha Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54704
  2. 2026-10-03 Alias added: GHSA-rwqx-fvqh-6wm4

References

Advisory 2

Other 4

  • TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
  • TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
  • TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
  • TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
  • TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
  • TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences