CVE-2026-33701
published 2026-03-27CVE-2026-33701: OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.93%
56.3th percentile
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linuxfoundation | opentelemetry_instrumentation_for_java | < 2.26.1 | 2.26.1 |
| open-telemetry | opentelemetry-java-instrumentation | < 2.26.1 | 2.26.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect JVM processes launched with the OpenTelemetry Java agent AND an exposed JMX/RMI port on JDK ≤ 16 — the combination is the exploitable attack surface ↗
- →Alert on JVM command-line arguments containing both `-javaagent` (referencing opentelemetry-javaagent) and `-Dcom.sun.management.jmxremote.port` on hosts running JDK 16 or earlier ↗
- →Monitor for unexpected inbound network connections to the configured JMX/RMI port on instrumented JVMs; unauthenticated deserialization payloads arriving on this port are the exploitation vector ↗
- →Verify the system property `-Dotel.instrumentation.rmi.enabled=false` is set as a workaround; absence of this flag on vulnerable JDK versions indicates unmitigated exposure ↗
- →Scan classpaths of instrumented JVMs for known Java deserialization gadget-chain libraries (e.g., commons-collections, spring-core); their presence is the third required condition for exploitation ↗
- →Flag use of affected Maven artifacts `io.opentelemetry.javaagent:opentelemetry-javaagent` or `com.splunk:splunk-otel-javaagent` in versions prior to 2.26.1 in SCA/dependency scanning ↗
- ·Exploitation requires ALL THREE conditions simultaneously: (1) otel javaagent attached on JDK ≤ 16, (2) JMX/RMI port explicitly configured and network-reachable, (3) gadget-chain library on classpath. Missing any one condition prevents exploitation. ↗
- ·JDK 17 and later are NOT vulnerable due to built-in serialization filter improvements; no action required for JDK ≥ 17 beyond upgrading the agent. ↗
- ·Red Hat JBoss EAP 8 and EAP Expansion Pack ship opentelemetry-javaagent but are assessed as NOT affected. ↗
- ·Successful exploitation grants the attacker the same OS-level privileges as the user running the JVM process, not necessarily root. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
osv·2026-03-25
CVE-2026-33701 [CRITICAL] OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability:
1. OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`)
2. An RMI endpoint is network-reachable (e.g. JMX remote port, an RMI registry, or any application-exported RMI service)
3. A gadget-chain-compatible library is present on the classpath
### Impact
Arbitrary remote code execution with the privile
GHSA
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
ghsa·2026-03-25
CVE-2026-33701 [CRITICAL] CWE-502 OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability:
1. OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`)
2. An RMI endpoint is network-reachable (e.g. JMX remote port, an RMI registry, or any application-exported RMI service)
3. A gadget-chain-compatible library is present on the classpath
### Impact
Arbitrary remote code execution with the privile
Red Hat
io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
vendor_redhat·2026-03-27·CVSS 9.3
CVE-2026-33701 [CRITICAL] CWE-502 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/R
No detection rules found.
No public exploits indexed.
https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.26.1https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-xw7x-h9fj-p2c7https://access.redhat.com/security/cve/CVE-2026-33701https://bugzilla.redhat.com/show_bug.cgi?id=2452071https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33701.json
2026-03-27
Published