CVE-2026-337018.1HighCWE-502

CVE-2026-33701: OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

open-telemetry · opentelemetry-java-instrumentation

Affected: open-telemetry opentelemetry-java-instrumentation · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.0%probability of exploitation in the next 30 days

61st percentile

050100

Higher than 61% of scored CVEs

8.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK < 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

open-telemetry · opentelemetry-java-instrumentation< 2.26.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Deserialization of Untrusted Data · Deserialization and Object Injection
Vendor: open-telemetry
Published: March 2026
Band: Unlikely (under 1%), March 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-33701 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.