GitHub Advisoryadvisory · Maven

GHSA-rwqx-fvqh-6wm4 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

MEDIUM Published 2026-07-29 Modified 2026-07-29 Official page ↗
Aliases
CVE-2026-54704
Ecosystem
Maven
Packages
io.opentelemetry.javaagent:opentelemetry-javaagent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2026-07-29

Affected packages

• Maven io.opentelemetry.javaagent:opentelemetry-javaagent: < 2.28.0-alpha → fixed in 2.28.0-alpha

Description

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.

Related

Alias · CVE (1)

  • CVE-2026-54704 OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References