Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-33701: OpenTelemetry Java: Unrestricted Code Can Run on Your Server
CVE-2026-33701 · published 3 days ago
Summary
If you use OpenTelemetry Java with a remote management port, a malicious person could potentially take control of your server by sending it a specially crafted message. This only happens if you have a specific library installed and the OpenTelemetry Java agent is running. To fix this, update OpenTelemetry Java to version 2.26.1 or later, or disable the RMI integration by setting a system property.
What to do
- Update opentelemetry io.opentelemetry.javaagent:opentelemetry-javaagent to version 2.26.1.
- Update io.opentelemetry.javaagent:opentelemetry-javaagent to version 2.26.1.
- Update io.opentelemetry.javaagent:opentelemetry-javaagent to version 2.10.0-aikido.1.
- Update io.root.io.opentelemetry.javaagent:opentelemetry-javaagent to version 2.10.0-root.io.1.
- Update linuxfoundation opentelemetry_instrumentation_for_java to version 2.26.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | opentelemetry | io.opentelemetry.javaagent:opentelemetry-javaagent |
< 2.26.1 Fix: upgrade to 2.26.1
|
| maven | – | io.opentelemetry.javaagent:opentelemetry-javaagent |
< 2.26.1 Fix: upgrade to 2.26.1
|
| – | open-telemetry | opentelemetry-java-instrumentation | < 2.26.1 |
| – | linuxfoundation | opentelemetry_instrumentation_for_java |
< 2.26.1 cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:*:*:*:*:*:*:*:* |
| Root:Maven | – | io.opentelemetry.javaagent:opentelemetry-javaagent |
< 2.10.0-aikido.1 Fix: upgrade to 2.10.0-aikido.1
|
| Root:Maven | – | io.root.io.opentelemetry.javaagent:opentelemetry-javaagent |
< 2.10.0-root.io.1 Fix: upgrade to 2.10.0-root.io.1
|
Original advisory text
CVE-2026-33701 in io.opentelemetry.javaagent:opentelemetry-javaagent - Patched by Root
Root has patched CVE-2026-33701 in the io.opentelemetry.javaagent:opentelemetry-javaagent package for Root:Maven. Multiple fixed versions available.
References
- https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/ad...
- https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4...
- https://github.com/advisories/GHSA-xw7x-h9fj-p2c7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33701... Vendor Advisory
- https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/ta...
- https://github.com/open-telemetry/opentelemetry-java-instrumentation Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-33701
- https://access.redhat.com/security/cve/CVE-2026-33701
- https://bugzilla.redhat.com/show_bug.cgi?id=2452071
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33701.json
Severity
9.3
Critical
CVSS 4.0: 9.3 (GHSA)
Exploitation
EPSS <1%
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published31 Aug 2026
Updated31 Aug 2026
First seen25 Mar 2026
Sources
GHSA-xw7x-h9fj-p2c7 · GHSA
CVE-2026-33701 · NVD
GHSA-xw7x-h9fj-p2c7 · OSV
CVE-2026-33701 · MITRE
CVE-2026-33701 · OSV
Monitor software like this
Free during beta