6.5
Medium
CVE-2026-54704 OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
Description
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry-java-instrumentation 2.28 | earliest → < 2.28.0 | 2.28.0 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of opentelemetry-java-instrumentation
The 4 CVEs of opentelemetry-java-instrumentation →
CVE-2026-54712
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
5.3
Medium
CVE-2026-33701
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
9.3
Critical
CVE-2023-39951
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
6.5
Medium