CVE-2026-33701

🗓️ 27 Mar 2026 00:01:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 66 Views🌐 WEB

OpenTelemetry RMI deserialization may allow remote code execution on Java 16 or earlier; upgrade to 2.26.1+ or disable.

Reporter	Title	Published	Views	Family All 19
IBM Security Bulletins	Security Bulletin: Cross-site scripting, authentication bypass by spoofing, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	18 May 202616:41	–	ibm
ATTACKERKB	CVE-2026-33701	27 Mar 202600:01	–	attackerkb
Circl	CVE-2026-33701	27 Mar 202602:50	–	circl
CNNVD	OpenTelemetry Instrumentation for Java 代码问题漏洞	27 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33701 OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution	27 Mar 202600:01	–	cvelist
Elastic	Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)	30 Mar 202614:17	–	elastic
GithubExploit	Exploit for Deserialization of Untrusted Data in Linuxfoundation Opentelemetry_Instrumentation_For_Java	4 Apr 202611:14	–	githubexploit
Github Security Blog	OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution	25 Mar 202621:27	–	github
Kitploit	CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation	10 Sep 202601:34	–	kitploit
NVD	CVE-2026-33701	27 Mar 202601:16	–	nvd

NVD

Vulners

Node

linuxfoundation opentelemetry_instrumentation_for_javaRange<2.26.1

[
  {
    "vendor": "open-telemetry",
    "product": "opentelemetry-java-instrumentation",
    "versions": [
      {
        "version": "< 2.26.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/open-telemetry/opentelemetry-java-instrumentation/commit/9cf4fbaaa9e79226142b2ed42a6f6b4ac0be2197
github	www.github.com/open-telemetry/opentelemetry-java-instrumentation/releases/tag/v2.26.1
github	www.github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-xw7x-h9fj-p2c7
access	www.access.redhat.com/security/cve/CVE-2026-33701
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33701.json

Parameter	Position	Path	Description	CWE
io.opentelemetry.javaagent.context-call	binary	io.opentelemetry.javaagent.context-call	RMI context-call endpoint used for deserialization; unsafe deserialization can lead to gadget chain execution.	CWE-502
io.opentelemetry.javaagent.context-call-v2	binary	io.opentelemetry.javaagent.context-call-v2	Updated RMI endpoint context-call-v2 avoiding legacy deserialization path; potential exploit via old endpoint blocked in newer versions.	CWE-502

04 Aug 2026 13:18Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.18.1 - 9.8

CVSS 49.3

EPSS0.00921

SSVC

CWE-502