CVE-2026-54704: OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.
Other sources
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.opentelemetry.javaagent:opentelemetry-javaagentto a version that resolves this vulnerability.Fixed in 2.28.0-alpha - Upgrade
Upgrade
OpenTelemetry Java Instrumentation (JDBC auto-instrumentation)to a version that resolves this vulnerability.Fixed in 2.28.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54704?
CVE-2026-54704 has a medium severity rating of 6.5.
How do I fix CVE-2026-54704?
To fix CVE-2026-54704, update the OpenTelemetry Java Instrumentation to version 2.28.0 or later.
What causes CVE-2026-54704?
CVE-2026-54704 is caused by the JDBC auto-instrumentation not sanitizing clear-text passwords in SQL CONNECT statements when they are double-quoted.
What are the risks associated with CVE-2026-54704?
The risks associated with CVE-2026-54704 include potential exposure of clear-text database passwords through logging.
Which versions of OpenTelemetry are affected by CVE-2026-54704?
CVE-2026-54704 affects versions of OpenTelemetry Java Instrumentation prior to 2.28.0.