CVE-2026-54704

Maven/io.opentelemetry.javaagent:opentelemetry-javaagent CVE-2026-54704: medium 6.5

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

Action: Upgrade io.opentelemetry.javaagent:opentelemetry-javaagent to 2.28.0-alpha or later.

Affected

Fixed versions

Sources

• osv: GHSA-rwqx-fvqh-6wm4
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4
• https://nvd.nist.gov/vuln/detail/CVE-2026-54704
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/18754
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/commit/7ac7fa6fda6c2e3b65bc5d3c6eba050311a49511
• https://github.com/open-telemetry/opentelemetry-java-instrumentation
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.28.0

CVE-2026-54704 · published 2026-07-29T17:18:34Z · modified 2026-07-29T17:30:32.422625572Z · JSON