CVE-2026-54704: OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends.
References
- github.com/advisories/GHSA-rwqx-fvqh-6wm4
- github.com/open-telemetry/opentelemetry-java-instrumentation/commit/7ac7fa6fda6c2e3b65bc5d3c6eba050311a49511
- github.com/open-telemetry/opentelemetry-java-instrumentation/pull/18754
- github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.28.0
- github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-rwqx-fvqh-6wm4
- nvd.nist.gov/vuln/detail/CVE-2026-54704
Code Behaviors & Features
Detect and mitigate CVE-2026-54704 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →