CVE catalog
CVE-2026-33701
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint
- Severity
- Critical · CVSS 9.3
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.94% · Oct 25, 2026
A flaw was found in OpenTelemetry Java Instrumentation. This vulnerability allows a remote attacker with network access to a Java Management Extensions (JMX) or Remote Method Invocation (RMI) port on an instrumented Java Virtual Machine (JVM) running Java Development Kit (JDK) version 16 or earlier to achieve arbitrary remote code execution. This is possible because the RMI instrumentation registers a custom endpoint that deserializes incoming data without proper serialization filters, provided a compatible gadget-chain library is present on the classpath. Successful exploitation grants the attacker the same privileges as the user running the affected JVM. io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | opentelemetry_instrumentation_for_java | Not reported | 2.26.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | opentelemetry_instrumentation_for_java | cpe | Not reported | 2.26.1 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: