{"id":"CVE-2026-54704","aliases":["EUVD-2026-41151","GHSA-rwqx-fvqh-6wm4"],"status":"published","title":"OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords","description":"OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00379,"percentile":0.3236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2026-07-01T21:15:37Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Maven","package":"io.opentelemetry.javaagent:opentelemetry-javaagent","fixed_in":["2.28.0-alpha"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.opentelemetry.javaagent:opentelemetry-javaagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.0-alpha"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.opentelemetry.javaagent:opentelemetry-javaagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.0-alpha"}]}],"versions":["0.12.0","0.12.1","0.13.0","0.13.1","0.14.0","0.15.0","0.15.1","0.16.0","0.16.1","0.17.0","1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.11.0","1.11.1","1.12.0","1.12.1","1.13.0","1.13.1","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.19.1","1.19.2","1.2.0","1.20.0","1.20.1","1.20.2","1.21.0","1.22.0","1.22.1","1.23.0","1.24.0","1.25.0","1.25.1","1.26.0","1.27.0","1.28.0","1.29.0","1.3.0","1.3.1","1.30.0","1.31.0","1.32.0","1.32.1","1.33.0","1.33.1","1.33.2","1.33.3","1.33.4","1.33.5","1.33.6","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.5.3","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0","1.9.1","1.9.2","2.0.0","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.15.0","2.16.0","2.17.0","2.17.1","2.18.0","2.18.1","2.19.0","2.2.0","2.20.0","2.20.1","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.26.1","2.27.0","2.3.0","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0"]}],"products":[{"vendor":"linuxfoundation","product":"opentelemetry_instrumentation_for_java"},{"vendor":"open-telemetry","product":"opentelemetry-java-instrumentation"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54704","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/18754","tags":["web"]},{"url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/7ac7fa6fda6c2e3b65bc5d3c6eba050311a49511","tags":["web"]},{"url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.28.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rwqx-fvqh-6wm4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54704.json","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-java-instrumentation","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54704","title":"OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords","description":"OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.","status":"published","published":"2026-07-01T21:15:37.903Z","modified":"2026-07-02T12:23:50.336Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-41151","description":"OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.","status":"published","published":"2026-07-01T21:15:37Z","modified":"2026-07-02T12:23:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:17.786883Z"}],"ghsa":[{"id":"GHSA-rwqx-fvqh-6wm4","title":"OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords","description":"OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.","status":"published","published":"2026-07-29T17:18:34Z","modified":"2026-07-29T17:18:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-54704","description":"OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.","status":"published","published":"2026-07-01T22:16:50.05Z","modified":"2026-10-25T16:10:00.147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:12:27.199837Z"}],"osv":[{"id":"CVE-2026-54704","title":"OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords","description":"OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.","status":"published","published":"2026-07-01T21:15:37.903Z","modified":"2026-10-28T02:30:27.469159605Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-rwqx-fvqh-6wm4","title":"OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords","description":"OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.","status":"published","published":"2026-07-29T17:18:34Z","modified":"2026-07-29T17:30:32.422625572Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:56.639206Z"}]}}