Vulnerability · Published Oct 2, 2026 · Assigned by GitHub_M
CVE-2026-104872Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Medium 5.8
In plain English
A medium-severity sensitive data in logs in opentelemetry-js-contrib from open-telemetry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @opentelemetry/instrumentation-cassandra-driver | 0.66.0 | GHSA-qqmp-wf37-98f9 |
| npm | @opentelemetry/instrumentation-knex | 0.65.0 | GHSA-qqmp-wf37-98f9 |
| npm | @opentelemetry/instrumentation-mongoose | 0.67.0 | GHSA-qqmp-wf37-98f9 |
| npm | @opentelemetry/instrumentation-mysql | 0.67.0 | GHSA-qqmp-wf37-98f9 |
| npm | @opentelemetry/instrumentation-mysql2 | 0.67.0 | GHSA-qqmp-wf37-98f9 |
| npm | @opentelemetry/instrumentation-oracledb | 0.46.0 | GHSA-qqmp-wf37-98f9 |
| npm | @opentelemetry/instrumentation-pg | 0.73.0 | GHSA-qqmp-wf37-98f9 |
| npm | @opentelemetry/instrumentation-tedious | 0.40.0 | GHSA-qqmp-wf37-98f9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | opentelemetry-js-contrib | < 27e172a9e0d549559056ccd58f27d13467454156 |
| @opentelemetry | instrumentation-cassandra-driver | < 0.66.0 |
| @opentelemetry | instrumentation-knex | < 0.65.0 |
| @opentelemetry | instrumentation-mongoose | < 0.67.0 |
| @opentelemetry | instrumentation-mysql | < 0.67.0 |
| @opentelemetry | instrumentation-mysql2 | < 0.67.0 |
| @opentelemetry | instrumentation-oracledb | < 0.46.0 |
| @opentelemetry | instrumentation-pg | < 0.73.0 |
| @opentelemetry | instrumentation-tedious | < 0.40.0 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9 x_refsource_CONFIRM
- https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585 x_refsource_MISC
- https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156 x_refsource_MISC
- https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037 x_refsource_MISC