Description
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.
Published: 2026-07-01
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OpenTelemetry Java Instrumentation versions before 2.28.0 allow JDBC auto‑instrumentation to trace password is double‑quoted in an SQL CONNECT statement. Those credentials are then exported to observability backends, making them available in logs (CWE‑532).

Affected Systems

The affected vendor is OpenTelemetry and the product is OpenTelemetry Java Instrumentation. All releases before 2.28.0 are vulnerable; the issue was addressed in version 2.28.0 and later releases are not impacted.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% and it is not listed in the CISA KEV catalog. The likely attack vector the application establish JDBC connections with double‑quoted passwords, causing those credentials to be recorded in span data that may be transmitted to backend collectors. If by an adversary the credentials could be recovered from trace logs, posing a moderate risk, especially in environments where trace data is exposed or retained for long periods.

Generated by OpenCVE AI on July 21, 2026 at 13:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the OpenTelemetry Java Instrumentation library to version 2.28.0, which removes unsanitized password logging from JDBC auto‑instrumentation.
  • Reconfigure the library to disable JDBC auto‑instrumentation or apply a custom filter that masks or excludes password fields from trace attributes.
  • Restrict access to observability backends so that trace data is not exposed to unauthorized parties.

Generated by OpenCVE AI on July 21, 2026 at 13:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Opentelemetry
Opentelemetry opentelemetry-java-instrumentation
Vendors & Products Opentelemetry
Opentelemetry opentelemetry-java-instrumentation

Wed, 01 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.
Title OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
Weaknesses CWE-532
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Opentelemetry Opentelemetry-java-instrumentation
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-02T12:23:50.336Z

Reserved: 2026-06-15T22:58:06.563Z

Link: CVE-2026-54704

cve-icon Vulnrichment

Updated: 2026-07-02T12:23:47.315Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T13:15:05Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File