Em resumo
- CVE-2026-33701 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta io.opentelemetry.javaagent:opentelemetry-javaagent, opentelemetry instrumentation for java (linuxfoundation).
- Chance de exploração nos próximos 30 dias (EPSS): 0.94%, maior que 60.8% das vulnerabilidades.
- Correção: atualize para 2.26.1 ou posterior.
Description
In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability:
- OpenTelemetry Java instrumentation is attached as a Java agent (
-javaagent)
- An RMI endpoint is network-reachable (e.g. JMX remote port, an RMI registry, or any application-exported RMI service)
- A gadget-chain-compatible library is present on the classpath
Impact
Arbitrary remote code execution with the privileges of the user running the instrumented JVM.
Recommendation
Upgrade to version 2.26.1 or later.
Workarounds
Set the following system property to disable the RMI integration:
-Dotel.instrumentation.rmi.enabled=false
Credits
This vulnerability was responsibly disclosed in coordination with Datadog.
NVD description
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.
Mais vulnerabilidades de io.opentelemetry.javaagent:opentelemetry-javaagent
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free