@opentelemetry
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| auto-instrumentations-node | 1 | – | May 27, 2026 |
| exporter-prometheus | 1 | – | May 27, 2026 |
| instrumentation-cassandra-driver | 1 | – | Oct 2, 2026 |
| instrumentation-knex | 1 | – | Oct 2, 2026 |
| instrumentation-mongoose | 1 | – | Oct 2, 2026 |
| instrumentation-mysql | 1 | – | Oct 2, 2026 |
| instrumentation-mysql2 | 1 | – | Oct 2, 2026 |
| instrumentation-oracledb | 1 | – | Oct 2, 2026 |
| instrumentation-pg | 1 | – | Oct 2, 2026 |
| instrumentation-tedious | 1 | – | Oct 2, 2026 |
| opentelemetry-exporter-otlp-proto-http | 1 | – | Oct 18, 2026 |
| sdk-node | 1 | – | May 27, 2026 |
Exploited and recent CVEs
- CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
- CVE-2026-44902 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request 0.5%
- CVE-2026-44902 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request 0.5%
- CVE-2026-44902 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request 0.5%