CVE-2026-33701

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33701
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33701.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33701
Aliases
Published
2026-03-27T00:01:12.327Z
Modified
2026-08-18T13:03:08.213762Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
Details

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (-javaagent) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via -Dcom.sun.management.jmxremote.port and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property -Dotel.instrumentation.rmi.enabled=false to disable the RMI integration.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33701.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-502"
    ]
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-java-instrumentation

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-java-instrumentation
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.26.1"
        }
    ],
    "cpe": "cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.1
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.4.0
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v2.*
v2.26.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33701.json"
vanir_signatures_modified 
"2026-08-18T13:03:08Z"
vanir_signatures 
[
    {
        "source": "https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197",
        "digest": {
            "line_hashes": [
                "145146964130739278061362787386149672567",
                "110143348512141934348981655546618302961",
                "304660518431869667895845858418993958526",
                "248190926684088238293627193349130086347"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2026-33701-531493bb",
        "target": {
            "file": "instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPropagator.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197",
        "digest": {
            "length": 352.0,
            "function_hash": "221444182698632161206033477786300125418"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2026-33701-78505046",
        "target": {
            "function": "read",
            "file": "instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPayload.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197",
        "digest": {
            "length": 84.0,
            "function_hash": "20913437022761566063265252032353579378"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2026-33701-8368f2c4",
        "target": {
            "function": "write",
            "file": "instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPayload.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197",
        "digest": {
            "line_hashes": [
                "126134203770309751702335519877522762835",
                "228626441916330252419959349013129730318",
                "1988768274064939067375600370942435272",
                "58571396959093387754190081535405630093",
                "46603494266925261424277769889619275519",
                "23286768289580129798914219032548910738",
                "151122031756710207333341886062482190118",
                "206300600285113959731479187357900309001",
                "9274895510806208087549852479874325967",
                "237090651252061275459834858927032902659",
                "64350905441455634590126612065787179136",
                "283256902345324993772464557523833344641",
                "69987207188414593975449818690367637681",
                "195902048044080116922127280929108158569",
                "264664570558670155162234521454778943070",
                "235826972355539603299769320459512193970",
                "89820375791517327547941121829476679856",
                "248975887933514061755453911128247129679",
                "266835320481486845305826885770403958480",
                "327854459917676628668212134075422366881",
                "335236992405859826359138809492078658698",
                "263175956302215908585929197545941730760",
                "100321630001120542948195545534518402359",
                "271462825181851780192466165276506038236",
                "206994538422235210259510286059246291976"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2026-33701-b95a85a2",
        "target": {
            "file": "instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPayload.java"
        },
        "deprecated": false
    }
]