com.splunk/splunk-otel-javaagent vulnerabilities

Latest com.splunk/splunk-otel-javaagent CVEs

Newest publication first

1. GHSA-h8w2-rv57-vc6f splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution

   Published 2026-03-26

   Critical·CVSS 9.3

   In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.