OpenTelemetry Java Instrumentation CVE-2026-54704

Three conditions must align for exploitation: (1) the application runs OpenTelemetry Java Instrumentation prior to 2.28.0 with JDBC auto-instrumentation active (enabled by default when a JDBC driver is on the classpath); (2) the database connection's password value appears as a double-quoted string in the SQL CONNECT statement - passwords using single-quoted, unquoted, or parameterized formats are presumably sanitized correctly and are not affected; (3) the attacker possesses read access to the observability backend receiving the exported spans. Exploitation is passive - the credential leaks automatically during normal application operation; no active interaction with the Java application or database is required from the attacker's side. Limiting factors: non-default double-quote password encoding, and the requirement for observability backend access, which is typically restricted to operations or engineering staff rather than arbitrary network actors.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), correctly reflecting a network-reachable, low-complexity flaw with High confidentiality impact but no integrity or availability consequence. PR:L captures that an attacker requires read access to the observability backend rather than to the Java application itself. No EPSS data was provided in the intelligence, precluding probability-based prioritization. Neither a CISA KEV listing nor a public POC exists at time of analysis, indicating no public weaponization. Real-world risk is substantially elevated in organizations where telemetry data is broadly shared - federated dashboards, multi-tenant observability SaaS, or pipelines forwarding traces to SIEM systems - because any party with span read access gains database credentials. Organizations with tightly access-controlled, internal-only observability backends face meaningfully lower practical risk despite the same CVSS score. The double-quote triggering condition narrows the affected population to applications whose JDBC URLs or connection properties express passwords in double-quoted form, which is a less common but valid quoting convention.

An attacker with read access to a shared Jaeger or Zipkin instance - for example, a developer with dashboard access in a multi-team environment - queries historical JDBC spans and identifies CONNECT statement attributes containing double-quoted database passwords in plaintext. The attacker extracts the credential, authenticates directly to the target database bypassing application-layer controls, and begins enumerating or exfiltrating sensitive data. No public POC exists, but exploitation requires only standard observability UI or API query access, not specialized tooling.