{"id":"CVE-2026-33701","summary":"OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution","details":"OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK \u003e= 17, no action is required, but upgrading is strongly encouraged. For JDK \u003c 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.","aliases":["GHSA-xw7x-h9fj-p2c7"],"modified":"2026-08-18T13:03:08.213762Z","published":"2026-03-27T00:01:12.327Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33701.json"},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.26.1"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33701.json"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-33701"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33701.json"},{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-xw7x-h9fj-p2c7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33701"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452071"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-telemetry/opentelemetry-java-instrumentation","events":[{"introduced":"0"},{"fixed":"9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.26.1"}],"source":["AFFECTED_FIELD","CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:*"}}],"versions":["v2.26.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.1","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.0","v0.6.1","v0.6.0","v0.4.0","v0.3.0","v0.2.2","v0.2.1","v0.2.0","v0.1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33701.json","vanir_signatures_modified":"2026-08-18T13:03:08Z","vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["145146964130739278061362787386149672567","110143348512141934348981655546618302961","304660518431869667895845858418993958526","248190926684088238293627193349130086347"]},"id":"CVE-2026-33701-531493bb","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197","target":{"file":"instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPropagator.java"}},{"digest":{"function_hash":"221444182698632161206033477786300125418","length":352},"id":"CVE-2026-33701-78505046","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197","target":{"file":"instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPayload.java","function":"read"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"20913437022761566063265252032353579378","length":84},"id":"CVE-2026-33701-8368f2c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197","target":{"file":"instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPayload.java","function":"write"}},{"source":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197","target":{"file":"instrumentation/rmi/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/rmi/context/ContextPayload.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["126134203770309751702335519877522762835","228626441916330252419959349013129730318","1988768274064939067375600370942435272","58571396959093387754190081535405630093","46603494266925261424277769889619275519","23286768289580129798914219032548910738","151122031756710207333341886062482190118","206300600285113959731479187357900309001","9274895510806208087549852479874325967","237090651252061275459834858927032902659","64350905441455634590126612065787179136","283256902345324993772464557523833344641","69987207188414593975449818690367637681","195902048044080116922127280929108158569","264664570558670155162234521454778943070","235826972355539603299769320459512193970","89820375791517327547941121829476679856","248975887933514061755453911128247129679","266835320481486845305826885770403958480","327854459917676628668212134075422366881","335236992405859826359138809492078658698","263175956302215908585929197545941730760","100321630001120542948195545534518402359","271462825181851780192466165276506038236","206994538422235210259510286059246291976"]},"id":"CVE-2026-33701-b95a85a2","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}