CVE-2026-33701: OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: 1. OpenTelemetry Java instrumentation is attached as a Java agent (-javaagent) 2. An RMI endpoint is network-reachable (e.g. JMX remote port, an RMI registry, or any application-exported RMI service) 3. A gadget-chain-compatible library is present on the classpath
Impact Arbitrary remote code execution with the privileges of the user running the instrumented JVM.
Recommendation Upgrade to version 2.26.1 or later.
Workarounds Set the following system property to disable the RMI integration:
-Dotel.instrumentation.rmi.enabled=false
Credits This vulnerability was responsibly disclosed in coordination with Datadog.
Other sources
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (-javaagent) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via -Dcom.sun.management.jmxremote.port and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property -Dotel.instrumentation.rmi.enabled=false to disable the RMI integration.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.opentelemetry.javaagent:opentelemetry-javaagentto a version that resolves this vulnerability.Fixed in 2.26.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.26.1 - Configuration
Disable the RMI integration by setting the system property -Dotel.instrumentation.rmi.enabled=false (workaround to mitigate unsafe RMI deserialization when instrumentation is attached as a -javaagent on Java 16 or earlier).
OpenTelemetry Java instrumentation Dotel.instrumentation.rmi.enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33701?
CVE-2026-33701 has a high severity level due to the potential for remote code execution.
How do I fix CVE-2026-33701?
To fix CVE-2026-33701, upgrade to version 2.26.1 or later of the opentelemetry-javaagent.
What systems are affected by CVE-2026-33701?
CVE-2026-33701 affects versions prior to 2.26.1 of the opentelemetry-javaagent.
Can CVE-2026-33701 be exploited remotely?
Yes, an attacker with network access to a JMX or RMI port can exploit CVE-2026-33701.
Does CVE-2026-33701 involve deserialization vulnerabilities?
Yes, CVE-2026-33701 involves deserializing incoming data without applying serialization filters.