GHSA-rwqx-fvqh-6wm4: OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
mediumvulnerability
security
Summary
OpenTelemetry Java Instrumentation has a vulnerability in its JDBC auto-instrumentation (automatic code monitoring for database connections) that logs database passwords in clear text, meaning anyone who reads the logs can see the actual passwords. This is a confidentiality issue because it exposes sensitive authentication information that should remain secret.
Vulnerability Details
EPSS (30-day exploit probability)
EPSS: 0.2%
Patch Available
Yes
Disclosure Date
July 29, 2026
Classification
Attack Type
PII Leakage
Attack SophisticationTrivial
Impact (CIA+S)
confidentiality
Affected Vendors
Affected Packages
io.opentelemetry.javaagent:opentelemetry-javaagent@< 2.28.0-alpha (fixed: 2.28.0-alpha)
Related Issues
Monthly digest — independent AI security research
Original source: https://github.com/advisories/GHSA-rwqx-fvqh-6wm4
First tracked: July 29, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 72%