{"uuid": "f5dfc0fa-6f36-4186-b7df-eda8809631d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54704", "type": "seen", "source": "https://gist.github.com/alon710/4dd54cb025c6b4b717455d6420807f40", "content": "# CVE-2026-54704: CVE-2026-54704: Sensitive Data Exposure in OpenTelemetry Java Instrumentation SQL Sanitizer\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54704\n\n## Summary\nA sensitive data exposure vulnerability (CWE-532) exists in OpenTelemetry Java Instrumentation prior to version 2.28.0. The JDBC auto-instrumentation component's SQL statement sanitizer contains lexer flaws that prevent the correct redaction of administrative passwords under specific conditions, such as when double-quotes represent identifiers or during multi-statement executions separated by semicolons.\n\n## TL;DR\nFlaws in the OpenTelemetry JFlex SQL sanitizer allowed unredacted database credentials to leak into trace spans when using double quotes or executing multi-statement queries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-532\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5\n- **EPSS Score**: 0.00224\n- **Impact**: Sensitive Data Exposure\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not in CISA KEV\n\n## Affected Systems\n\n- OpenTelemetry Java Agent\n- OpenTelemetry Java Instrumentation JDBC Component\n- **opentelemetry-java-instrumentation**: < 2.28.0 (Fixed in: `2.28.0`)\n\n## Mitigation\n\n- Upgrade the OpenTelemetry Java Agent to version 2.28.0 or newer.\n- Avoid using double-quoted database passwords in administrative statements.\n- Disable multi-query statement execution within application database drivers.\n- Implement collector-side processors to filter or scrub traces containing passwords.\n\n**Remediation Steps:**\n1. Identify all JVM deployments using opentelemetry-javaagent version < 2.28.0.\n2. Update build configurations, Dockerfiles, and deployment manifests to pull version 2.28.0.\n3. Restart target JVM instances to load the updated Java Agent.\n4. Query tracing platforms (e.g., Jaeger, Tempo) for any stored plain-text passwords and purge the affected historical indexes.\n\n## References\n\n- [GHSA-rwqx-fvqh-6wm4](https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54704)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-54704)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54704) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T19:31:52.622911Z"}