CVE-2026-54704 Overview
CVE-2026-54704 affects OpenTelemetry Java Instrumentation, a library that provides auto-instrumentation and instrumentation for Java applications. The JDBC auto-instrumentation fails to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database credentials are captured in trace span attributes and forwarded to observability backends. The issue is classified under [CWE-532: Insertion of Sensitive Information into Log File]. Any downstream system or user with read access to traces can retrieve exposed passwords. The vulnerability affects all versions prior to 2.28.0 and is resolved in version 2.28.0.
Critical Impact
Clear-text database passwords are propagated to observability backends through JDBC trace spans, exposing credentials to anyone with access to telemetry data.
Affected Products
- OpenTelemetry Java Instrumentation versions prior to 2.28.0
- Java applications using JDBC auto-instrumentation from the affected library
- Observability pipelines ingesting spans emitted by vulnerable instrumentation
Discovery Timeline
- 2026-07-01 - CVE-2026-54704 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-54704
Vulnerability Analysis
OpenTelemetry Java Instrumentation intercepts JDBC calls to produce trace spans that describe database activity. Span attributes typically include the SQL statement, connection URL, and related metadata. To avoid leaking secrets, the instrumentation runs a sanitizer that removes passwords from SQL text before the span is exported.
The sanitizer handles common password syntaxes in CONNECT statements but does not correctly parse passwords wrapped in double quotes. When an application issues a statement such as CONNECT USER admin IDENTIFIED BY "secret", the double-quoted literal bypasses the redaction path. The unmodified SQL string is then attached to the span and delivered to any configured exporter.
Because telemetry frequently flows to shared observability platforms, exposed credentials can reach logging systems, tracing backends, and long-term storage. Attackers with read access to those systems, or with an ability to intercept exported spans in transit, can retrieve valid database credentials.
Root Cause
The root cause is incomplete input handling in the JDBC statement sanitizer. The parser recognizes single-quoted password literals but does not treat double-quoted literals as sensitive. This gap causes clear-text passwords to persist in the db.statement span attribute.
Attack Vector
Exploitation does not require code execution against the vulnerable host. An attacker with authenticated access to the observability backend, or access to intermediate telemetry storage, reads the span attribute directly. Insider access, misconfigured trace storage, and compromised third-party observability tooling all provide viable paths to the exposed credentials.
The vulnerability manifests only when applications use CONNECT statements with double-quoted passwords through JDBC drivers instrumented by the affected library. Refer to the GitHub Security Advisory for the reference implementation details.
Detection Methods for CVE-2026-54704
Indicators of Compromise
- Trace spans containing db.statement attributes with substrings resembling IDENTIFIED BY "..." or CONNECT ... "..."
- Presence of OpenTelemetry Java Instrumentation versions below 2.28.0 in application dependency manifests
- Unexpected access patterns against the observability backend targeting JDBC-related spans
Detection Strategies
- Query the tracing backend for span attributes containing double-quoted string literals adjacent to CONNECT, IDENTIFIED, or PASSWORD keywords.
- Scan build artifacts and container images for opentelemetry-javaagent and opentelemetry-instrumentation-* versions earlier than 2.28.0.
- Correlate database authentication events with recent observability backend reads to identify credential reuse.
Monitoring Recommendations
- Enable audit logging on tracing platforms and alert on bulk exports of db.statement attributes.
- Continuously inventory Java application dependencies and flag OpenTelemetry versions below 2.28.0.
- Monitor for database logins from source addresses that do not match approved application hosts.
How to Mitigate CVE-2026-54704
Immediate Actions Required
- Upgrade OpenTelemetry Java Instrumentation to version 2.28.0 or later across all Java workloads.
- Rotate database credentials that were used by applications running vulnerable instrumentation versions.
- Purge historical trace data known to contain unsanitized CONNECT statements from observability backends.
Patch Information
The maintainers fixed the sanitizer in OpenTelemetry Java Instrumentation 2.28.0. Details are published in the OpenTelemetry Java Instrumentation Security Advisory GHSA-rwqx-fvqh-6wm4. Update the Java agent JAR or the instrumentation library coordinates in build configuration to pull the fixed version.
Workarounds
- Disable JDBC statement capture by setting otel.instrumentation.jdbc.statement-sanitizer.enabled behavior to omit db.statement until the upgrade completes.
- Avoid double-quoted password syntax in application CONNECT statements and prefer parameterized authentication.
- Restrict access to trace storage with least-privilege roles and enforce encryption in transit for span exporters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
