CVE-2026-54704: OpenTelemetry Java JDBC Password Leak in Trace Spans

Technical summary

The vulnerability resides in OpenTelemetry Java Instrumentation's JDBC auto-instrumentation module, which intercepts database connection calls to extract telemetry data. The code attempts to sanitize passwords from SQL CONNECT statements by removing them before recording span attributes, but the sanitization logic contains a flaw: it fails to recognize passwords wrapped in double quotes as secrets requiring redaction. When a JDBC connection string uses double-quoted password syntax (e.g., CONNECT TO ... PASSWORD "secret123"), the password remains visible in the resulting span attributes. These attributes are then exported to configured observability backends as part of the trace context, exposing the credential in plaintext. The issue is classified under CWE-532 (Insertion of Sensitive Information into Log Files).

Business impact

Database credentials are among the highest-value targets in a breach. Leakage into observability platforms creates a secondary attack surface: any user, service account, or API key with read access to trace data gains database login credentials without requiring direct database access. This significantly expands the blast radius of an observability platform compromise or insider threat. Teams running OpenTelemetry Java Instrumentation with JDBC auto-instrumentation enabled are inadvertently storing production database passwords in systems that may have broader access controls than the database itself. Compliance frameworks (SOC 2, PCI-DSS, HIPAA) often mandate that credentials not be logged or exported to external systems, making this a compliance violation for regulated workloads.

Affected systems

The vulnerability affects OpenTelemetry Instrumentation for Java in versions prior to 2.28.0. This includes all deployments of the OpenTelemetry Java agent or library that include the JDBC auto-instrumentation component. Exposure is limited to applications using JDBC connections where the password field in the connection string is double-quoted. Organizations using single-quoted or unquoted password syntax in their JDBC connection strings are not affected by this specific flaw. The issue impacts any observability backend receiving traces from affected applications, whether self-hosted or SaaS-based.

Exploitability

Exploitation requires two conditions: (1) the application must be running an affected version of OpenTelemetry Java Instrumentation with JDBC auto-instrumentation enabled, and (2) database passwords in JDBC connection strings must be double-quoted. An attacker must then have authenticated access to the observability platform collecting the traces—either as a privileged user, a compromised service account, or via lateral movement from another breach. The CVSS score of 6.5 (Medium) reflects that authentication is required to access the observability backend, limiting the attack surface to internal threats or platform compromises. No remote unauthenticated exploitation is possible; however, once traces are exported, the credential exposure is passive and persistent.

Remediation

Upgrade OpenTelemetry Instrumentation for Java to version 2.28.0 or later, which includes a fix for the password sanitization logic to properly handle double-quoted passwords in JDBC CONNECT statements. Organizations should verify the upgrade includes the JDBC auto-instrumentation patch by consulting the vendor release notes. As an interim measure before patching, review JDBC connection string configurations across your environment and convert any double-quoted passwords to single-quoted or unquoted syntax, if your database driver supports it; however, this is a workaround, not a substitute for patching. Additionally, audit observability platform access logs to determine if any credentials matching known password formats appear in exported traces.

Patch guidance

Upgrade OpenTelemetry Instrumentation for Java to version 2.28.0 or later. For Maven-based projects, update the dependency version in pom.xml and rebuild. For Gradle projects, update the version in build.gradle. If you are using the OpenTelemetry Java agent JAR for bytecode instrumentation, download the patched version and restart all affected application instances with the new agent. Verify the patch by reviewing the release notes at the Linux Foundation OpenTelemetry project repository to confirm the JDBC sanitization fix is included. Rolling updates are recommended to avoid service disruption; monitor trace exports post-upgrade to confirm passwords are no longer appearing in span attributes.

Detection guidance

Search your observability platform's trace data for recognizable database credentials or password patterns in span attributes associated with JDBC operations. Look for span attributes named 'db.statement', 'db.connection_string', or similar that contain plaintext strings matching PASSWORD=[value] or PASSWD=[value] patterns, especially those enclosed in double quotes. If your observability platform supports it, query for traces containing common password indicators (regex patterns like PASSWORD", PASSWD", or similar) exported within the time window when OpenTelemetry Java Instrumentation was active. Review access logs for your observability platform to identify which users or services accessed trace data containing those credentials. Correlate the presence of credentials in traces with the version of OpenTelemetry Instrumentation in use by inspecting agent or library manifests on running application instances.

Why prioritize this

Although the CVSS score is Medium (6.5), this vulnerability warrants high priority because credentials are high-impact secrets. A single trace export exposes a database password to all users with observability platform read access—a much broader group than those with direct database access. This creates persistent risk until patched, as historical traces may retain the credential indefinitely. Organizations with strict compliance requirements (PCI-DSS, SOC 2, HIPAA) should treat this as urgent. Conversely, organizations that do not use JDBC auto-instrumentation or do not use double-quoted password syntax can defer patching to a standard maintenance window.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects Confidentiality impact (High) because passwords are exposed, balanced against the requirement for authenticated access to the observability backend (Privilege Required = Low) and the limitation to authenticated users within that system. The score does not account for the secondary risk that observability platforms often have broader or weaker access controls than databases, nor does it capture the likelihood of long-term credential persistence in trace storage. The severity is rated Medium rather than High because access to traces is limited to authenticated platform users, not the public internet. However, the practical impact on data confidentiality is substantial; security teams should consider this a High-priority remediation within their risk management framework.

Frequently asked questions