CVE-2026-104872 · GHSA-qqmp-wf37-98f9
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
- Risk score
- 43/100
- CVSS
- 5.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instru…
- Affected
- @opentelemetry/instrumentation-cassandra-driver (npm) < 0.66.0; @opentelemetry/instrumentation-tedious (npm) < 0.40.0; @opentelemetry/instrumentation-oracledb (npm) < 0.46.0; @opentelemetry/instrumentation-mongoose (npm) < 0.67.0
- Fix
- Upgrade @opentelemetry/instrumentation-cassandra-driver to 0.66.0; @opentelemetry/instrumentation-tedious to 0.40.0; @opentelemetry/instrumentation-oracledb to 0.46.0; @opentelemetry/instrumentation-mongoose to 0.67.0; @opentelemetry/instrumentation-mysql to 0.67.0; @opentelemetry/instrumentation-k…
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.8 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @opentelemetry/instrumentation-cassandra-driver | npm | < 0.66.0 | 0.66.0 |
| @opentelemetry/instrumentation-tedious | npm | < 0.40.0 | 0.40.0 |
| @opentelemetry/instrumentation-oracledb | npm | < 0.46.0 | 0.46.0 |
| @opentelemetry/instrumentation-mongoose | npm | < 0.67.0 | 0.67.0 |
| @opentelemetry/instrumentation-mysql | npm | < 0.67.0 | 0.67.0 |
| @opentelemetry/instrumentation-knex | npm | < 0.65.0 | 0.65.0 |
| @opentelemetry/instrumentation-mysql2 | npm | < 0.67.0 | 0.67.0 |
| @opentelemetry/instrumentation-pg | npm | < 0.73.0 | 0.73.0 |
References
- https://github.com/advisories/GHSA-qqmp-wf37-98f9
- https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9
- https://nvd.nist.gov/vuln/detail/CVE-2026-104872
- https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585
- https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156
- https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037
- https://github.com/advisories/GHSA-qqmp-wf37-98f9
Original description
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
Last activity 2 Oct 2026. Patch Forecast updates every hour.