CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-54704

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 12.9%

CVSS Severity

CVSS v3 Score 6.5

References

https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4

Products affected by CVE-2026-54704

Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.1.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.1.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.10.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.10.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.10.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.10.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.11.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.11.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.12.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.12.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.12.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.12.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.13.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.13.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.13.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.13.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.14.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.14.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.15.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.15.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.15.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.15.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.16.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.16.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.16.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.16.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.17.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.17.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.2.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.2.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.2.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.2.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.2.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.2.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.3.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.3.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.4.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.4.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.6.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.6.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.6.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.6.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.7.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.7.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.8.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.8.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 0.9.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:0.9.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.0.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.0.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.0.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.0.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.1.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.1.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.10.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.10.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.10.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.10.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.11.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.11.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.11.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.11.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.12.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.12.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.12.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.12.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.13.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.13.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.13.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.13.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.14.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.14.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.15.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.15.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.16.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.16.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.17.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.17.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.18.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.18.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.19.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.19.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.19.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.19.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.19.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.19.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.2.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.2.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.20.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.20.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.20.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.20.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.20.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.20.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.21.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.21.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.22.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.22.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.22.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.22.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.23.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.23.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.24.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.24.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.25.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.25.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.25.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.25.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.26.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.26.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.27.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.27.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.28.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.28.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.29.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.29.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.3.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.3.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.3.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.3.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.30.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.30.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.31.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.31.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.32.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.32.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.32.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.32.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.33.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.33.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.33.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.33.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.33.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.33.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.33.3

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.33.3
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.33.4

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.33.4
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.33.5

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.33.5
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.33.6

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.33.6
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.4.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.4.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.4.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.4.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.5.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.5.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.5.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.5.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.5.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.5.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.5.3

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.5.3
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.6.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.6.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.6.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.6.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.6.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.6.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.7.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.7.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.7.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.7.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.7.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.7.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.8.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.8.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.9.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.9.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.9.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.9.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 1.9.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:1.9.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.0.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.0.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.1.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.1.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.10.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.10.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.11.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.11.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.12.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.12.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.13.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.13.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.13.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.13.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.13.2

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.13.2
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.13.3

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.13.3
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.14.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.14.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.15.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.15.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.16.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.16.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.17.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.17.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.17.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.17.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.18.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.18.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.18.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.18.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.19.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.19.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.2.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.2.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.20.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.20.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.20.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.20.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.21.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.21.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.22.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.22.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.23.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.23.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.24.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.24.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.25.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.25.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.26.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.26.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.26.1

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.26.1
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.3.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.3.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.4.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.4.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.5.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.5.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.6.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.6.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.7.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.7.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.8.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.8.0
Linuxfoundation » Opentelemetry Instrumentation For Java » Version: 2.9.0

cpe:2.3:a:linuxfoundation:opentelemetry_instrumentation_for_java:2.9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-54704

Products

Pricing

Contact Us