CVE-2026-104872Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Updated under an hour ago ()
Does this affect you?
It affects open-telemetry opentelemetry-js-contrib and 8 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
- CVSS
- 5.8 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
- Weakness (CWE)
- CWE-532
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
open-telemetry opentelemetry-js-contrib open_telemetry:opentelemetry_js_contrib (from the name) | before 27e172a9e0d549559056ccd58f27d13467454156 | CNA record |
@opentelemetry instrumentation-cassandra-driver opentelemetry:instrumentation_cassandra_driver (from the name) | before 0.66.0 | CNA record |
@opentelemetry instrumentation-knex opentelemetry:instrumentation_knex (from the name) | before 0.65.0 | CNA record |
@opentelemetry instrumentation-mongoose opentelemetry:instrumentation_mongoose (from the name) | before 0.67.0 | CNA record |
@opentelemetry instrumentation-mysql opentelemetry:instrumentation_mysql (from the name) | before 0.67.0 | CNA record |
@opentelemetry instrumentation-mysql2 opentelemetry:instrumentation_mysql2 (from the name) | before 0.67.0 | CNA record |
@opentelemetry instrumentation-oracledb opentelemetry:instrumentation_oracledb (from the name) | before 0.46.0 | CNA record |
@opentelemetry instrumentation-pg opentelemetry:instrumentation_pg (from the name) | before 0.73.0 | CNA record |
@opentelemetry instrumentation-tedious opentelemetry:instrumentation_tedious (from the name) | before 0.40.0 | CNA record |
References
- https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9x-refsource-confirm
- https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585x-refsource-misc
- https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156x-refsource-misc
- https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.