Junglewise Threat Intelligence

CVE-2026-33701: OpenTelemetry Java Instrumentation RCE via Unsafe Deserialization in RMI

CVE-2026-33701 · Severity: critical · CVSS 9.8 · Published 2026-03-27

Technologies: io.opentelemetry.javaagent:opentelemetry-javaagent (Maven), Opentelemetry Java Instrumentation. Vendors: Opentelemetry, Linuxfoundation, Maven.

Executive brief

OpenTelemetry Java instrumentation, a tool used to monitor application performance, contains a vulnerability in how it handles remote communication. If an application is monitored using this tool and has certain common libraries installed, an attacker could remotely execute malicious code on the server. This could lead to a full system takeover, data theft, or service disruption.

Technical details

An unsafe deserialization vulnerability exists in the RMI (Remote Method Invocation) instrumentation of the OpenTelemetry Java agent. The component registers a custom endpoint that processes incoming data without applying necessary serialization filters. An attacker can exploit this by sending a crafted malicious object to a reachable JMX or RMI port. Successful exploitation requires the Java agent to be active, a reachable RMI/JMX endpoint, and the presence of a gadget-chain-compatible library on the application's classpath. This allows for arbitrary code execution with the privileges of the JVM process. The issue is fixed in version 2.26.1.

Affected products

  • OpenTelemetry opentelemetry-javaagent < 2.26.1

Timeline

  • 2026-03-23: patched: Fix committed and version 2.26.1 released.
  • 2026-03-25: advisory: GitHub Advisory published.

References

Related threats