Elastic OpenTelemetry Java Remote Code Execution Vulnerability

CERT-FR Security Advisories

Published March 31st, 2026

Detected March 31st, 2026

Summary

CERT-FR issued a security advisory warning of a critical remote code execution vulnerability (CVE-2026-33701) in Elastic OpenTelemetry Java affecting versions prior to 1.10.0. The vulnerability allows remote attackers to execute arbitrary code on affected systems. Organizations using the affected software should apply the vendor patch immediately.

View original document View source feed page

What changed

CERT-FR published security advisory CERTFR-2026-AVI-0379 disclosing a critical vulnerability in Elastic OpenTelemetry Java (versions prior to 1.10.0). The vulnerability, tracked as CVE-2026-33701 and sourced from Elastic Security Bulletin 385700, enables remote arbitrary code execution without authentication. The risk level is classified as critical due to the potential for complete system compromise.

Organizations using OpenTelemetry Java in affected versions must upgrade to version 1.10.0 or later immediately. No specific compliance deadline is stated, but due to the critical severity of remote code execution vulnerabilities, immediate patching is strongly recommended. Users should refer to the Elastic Security Bulletin for patch availability and implement compensating controls if patching cannot be performed promptly.

What to do next

Upgrade OpenTelemetry Java to version 1.10.0 or later using the Elastic Security Bulletin 385700
Review systems for signs of compromise if the affected software was exposed to untrusted networks
Implement network segmentation and input validation as compensating controls until patching is complete

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 31 mars 2026 N° CERTFR-2026-AVI-0379 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Elastic OpenTelemetry Java

Gestion du document

Risque

Exécution de code arbitraire à distance

Systèmes affectés

OpenTelemetry Java versions antérieurs à 1.10.0

Résumé

Une vulnérabilité a été découverte dans Elastic OpenTelemetry Java. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.