splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution
Date: 2026-03
Affected: maven/com.splunk:splunk-otel-javaagent
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-33701
CWE: CWE-1395
CWE-502

In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: 1. Splunk Distribution of OpenTelemetry Java is attached as a Java agent (`-javaagent`) 2. An RMI endpoint is network-reachable (e.g. JMX remote port, an RMI registry, or any application-exported RMI service) 3. A gadget-chain-compatible library is present on the classpath ### Impact Arbitrary remote code execution with the privileges of the user running the instrumented JVM. ### Recommendation Upgrade to version 2.26.1 or later. ### Workarounds Set the following system property to disable the RMI integration: ``` -Dotel.instrumentation.rmi.enabled=false ``` ### References [Advisory in OpenTelemetry Instrumentation for Java](https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-xw7x-h9fj-p2c7)


Mitigations:

Architectural layers (MAESTRO):