CVE-2026-54704

Summary

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

Severity

medium

CVSS

6.5

EPSS

0.4% (p32)

CWE

CWE-532

Also known as

GHSA-rwqx-fvqh-6wm4

Published

2026-07-29

Updated

2026-07-29

Advisory details

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.

References

• https://github.com/advisories/GHSA-rwqx-fvqh-6wm4
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4
• https://nvd.nist.gov/vuln/detail/CVE-2026-54704
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/18754
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/7ac7fa6fda6c2e3b65bc5d3c6eba050311a49511
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.28.0

Related advisories

• CVE-2026-33701 — critical · Maven/io.opentelemetry.javaagent:opentelemetry-javaagent
• CVE-2026-54712 — medium · Maven/io.opentelemetry.javaagent:opentelemetry-javaagent
• GHSA-v853-p72q-4cfw — high · PyPI/quart
• CVE-2026-86049 — high · PyPI/jupyter_server
• CVE-2026-61798 — high · Maven/io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl
• GHSA-p77j-g7h5-r2vw — high · PyPI/geolens
• CVE-2025-30066 — high · CI/CD/tj-actions/changed-files
• CVE-2026-113799 — medium · crates.io/slack-morphism

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity