cve.bz

CVE-2026-104872

5.8 mediumEPSS 0.2%

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.

CVSS 3.1
5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-25)
CWE
CWE-532
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-cassandra-driver<0.66.00.66.0
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-tedious<0.40.00.40.0
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-oracledb<0.46.00.46.0
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-mongoose<0.67.00.67.0
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-mysql<0.67.00.67.0
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-knex<0.65.00.65.0
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-mysql2<0.67.00.67.0
GHSA-qqmp-wf37-98f9npm@opentelemetry/instrumentation-pg<0.73.00.73.0

References

Check your stackJSON