DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54704: CVE-2026-54704: Sensitive Data Exposure in OpenTelemetry Java Instrumentation SQL Sanitizer

#security #cve #cybersecurity

CVE-2026-54704: Sensitive Data Exposure in OpenTelemetry Java Instrumentation SQL Sanitizer

Vulnerability ID: CVE-2026-54704
CVSS Score: 6.5
Published: 2026-07-29

A sensitive data exposure vulnerability (CWE-532) exists in OpenTelemetry Java Instrumentation prior to version 2.28.0. The JDBC auto-instrumentation component's SQL statement sanitizer contains lexer flaws that prevent the correct redaction of administrative passwords under specific conditions, such as when double-quotes represent identifiers or during multi-statement executions separated by semicolons.

TL;DR

Flaws in the OpenTelemetry JFlex SQL sanitizer allowed unredacted database credentials to leak into trace spans when using double quotes or executing multi-statement queries.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-532
  • Attack Vector: Network
  • CVSS Score: 6.5
  • EPSS Score: 0.00224
  • Impact: Sensitive Data Exposure
  • Exploit Status: Proof of Concept (PoC) documented
  • KEV Status: Not in CISA KEV

Affected Systems

  • OpenTelemetry Java Agent
  • OpenTelemetry Java Instrumentation JDBC Component
  • opentelemetry-java-instrumentation: < 2.28.0 (Fixed in: 2.28.0)

Code Analysis

Commit: 7ac7fa6

Redact sensitive SQL password phrases

Mitigation Strategies

  • Upgrade the OpenTelemetry Java Agent to version 2.28.0 or newer.
  • Avoid using double-quoted database passwords in administrative statements.
  • Disable multi-query statement execution within application database drivers.
  • Implement collector-side processors to filter or scrub traces containing passwords.

Remediation Steps:

  1. Identify all JVM deployments using opentelemetry-javaagent version < 2.28.0.
  2. Update build configurations, Dockerfiles, and deployment manifests to pull version 2.28.0.
  3. Restart target JVM instances to load the updated Java Agent.
  4. Query tracing platforms (e.g., Jaeger, Tempo) for any stored plain-text passwords and purge the affected historical indexes.

References

Read the full report for CVE-2026-54704 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)