{"action":"Upgrade com.splunk:splunk-otel-javaagent to 2.26.1 or later.","affected":[{"fixed":"2.26.1","introduced":"0"}],"component":"com.splunk:splunk-otel-javaagent","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["2.26.1"],"ghsa_id":"GHSA-h8w2-rv57-vc6f","id":"tcs_01M5N905B0B1H8HDBD3TXY9AND","modified_at":"2026-03-26T17:33:06.844664Z","published_at":"2026-03-26T17:22:53Z","references":["https://osv.dev/vulnerability/GHSA-h8w2-rv57-vc6f","https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-xw7x-h9fj-p2c7","https://github.com/signalfx/splunk-otel-java/security/advisories/GHSA-h8w2-rv57-vc6f","https://github.com/signalfx/splunk-otel-java"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-h8w2-rv57-vc6f","url":"https://osv.dev/vulnerability/GHSA-h8w2-rv57-vc6f"}],"summary":"splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution"}