CVE-2026-54704: OpenTelemetry Java Instrumentation Password Exposure

A critical security vulnerability, designated as CVE-2026-54704, has been discovered within the OpenTelemetry Java Instrumentation library. This vulnerability affects versions prior to 2.28.0 and poses a significant risk of sensitive data exposure within observability systems. The core of the issue lies in the JDBC auto-instrumentation component of the library. Specifically, when database passwords are included in SQL CONNECT statements and are enclosed in double-quotes, the instrumentation may fail to properly sanitize these credentials. This oversight results in the clear-text passwords being captured and added to trace span attributes. Consequently, these unsanitized passwords can then be exported to various observability backends, such as distributed tracing systems or log aggregators. This unintended exposure means that sensitive database credentials, which should remain confidential, could become accessible to anyone with access to the observability data. Such an incident could lead to unauthorized access to databases and compromise the security of an entire system. The vulnerability has been officially addressed and fixed in version 2.28.0 of the OpenTelemetry Java Instrumentation. Users are strongly advised to upgrade their installations to this version or newer to mitigate the risk of password exposure. This highlights the ongoing importance of careful data handling and robust security practices, even within observability tools designed to enhance system visibility. The CVSS score for this vulnerability is rated as Medium, with a base score of 6.5 (CVSS:3.1) and 6.8 (CVSS2), indicating a significant concern for affected systems.