CVE-2026-54704

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:*

History

25 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) La Instrumentación Java de OpenTelemetry proporciona auto-instrumentación y bibliotecas de instrumentación para Java. En versiones anteriores a la 2.28.0, la auto-instrumentación JDBC puede fallar al sanear contraseñas en sentencias SQL CONNECT cuando la contraseña está entre comillas dobles. Como resultado, las contraseñas de base de datos en texto claro pueden añadirse a los atributos de span de traza y exportarse a backends de observabilidad. Este problema ha sido solucionado en la versión 2.28.0.

Information

Published : 2026-07-01 22:16

Updated : 2026-10-25 16:10

NVD link : CVE-2026-54704

Mitre link : CVE-2026-54704

CVE.ORG link : CVE-2026-54704

JSON object : View

Products Affected

linuxfoundation

opentelemetry_instrumentation_for_java

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-54704", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54704", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T12:23:43.311803Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-java-instrumentation", "versions": [{"status": "affected", "version": "< 2.28.0"}]}]}], "published": "2026-07-01T22:16:50.050", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0."}, {"lang": "es", "value": "La Instrumentaci\u00f3n Java de OpenTelemetry proporciona auto-instrumentaci\u00f3n y bibliotecas de instrumentaci\u00f3n para Java. En versiones anteriores a la 2.28.0, la auto-instrumentaci\u00f3n JDBC puede fallar al sanear contrase\u00f1as en sentencias SQL CONNECT cuando la contrase\u00f1a est\u00e1 entre comillas dobles. Como resultado, las contrase\u00f1as de base de datos en texto claro pueden a\u00f1adirse a los atributos de span de traza y exportarse a backends de observabilidad. Este problema ha sido solucionado en la versi\u00f3n 2.28.0."}], "lastModified": "2026-10-25T16:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F01657B7-AE82-4217-AAF2-0AFA2525B699", "versionEndExcluding": "2.28.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}