PT-2026-28180 · Opentelemetry · @Opentelemetry/Instrumentation
Lauri Tulmin
·
Publicado
2026-03-25
·
Atualizado
2026-03-31
·
CVE-2026-33701
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenTelemetry Java Instrumentation versions prior to 2.26.1
Description
The Java instrumentation for OpenTelemetry registers a custom endpoint that deserializes incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could potentially achieve remote code execution. Three conditions must be met for exploitation: OpenTelemetry Java instrumentation must be attached as a Java agent (
-javaagent), a JMX/RMI port must be explicitly configured and network-reachable, and a gadget-chain-compatible library must be present on the classpath. Successful exploitation can lead to arbitrary remote code execution with the privileges of the user running the instrumented JVM.Recommendations
Versions prior to 2.26.1: Upgrade to version 2.26.1 or later.
As a workaround, set the system property
-Dotel.instrumentation.rmi.enabled=false to disable the RMI integration.Exploit
Correção
RCE
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
@Opentelemetry/Instrumentation