DataDog dd-trace-java up to 1.60.2 Environment Variable DD_INTEGRATION_RMI_ENABLED deserialization

Summaryinfo

A vulnerability classified as critical was found in DataDog dd-trace-java up to 1.60.2. Affected by this issue is some unknown functionality of the component Environment Variable Handler. Executing a manipulation of the argument DD_INTEGRATION_RMI_ENABLED can lead to deserialization. The identification of this vulnerability is CVE-2026-33728. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in DataDog dd-trace-java up to 1.60.2 and classified as critical. This vulnerability affects an unknown function of the component Environment Variable Handler. The manipulation of the argument DD_INTEGRATION_RMI_ENABLED with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK >= 8u121 < JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`.

The advisory is available at github.com. This vulnerability was named CVE-2026-33728 since 03/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 1.60.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Network Management Software

Vendor

• DataDog

Name

• dd-trace-java

Version

• 1.60.0
• 1.60.1
• 1.60.2

Website

• Product: https://github.com/DataDog/dd-trace-java/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion