All vulnerabilities
CVE-2026-104872GHSA-qqmp-wf37-98f9

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

open-telemetry @opentelemetry/instrumentation-cassandra-drivernpmDatabases
Open in ThreatlineRecord JSON
CVSS
5.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.66.0Also 0.40.0, 0.46.0 and 3 moreGitHub
Published2 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

  • 0.66.0@opentelemetry/instrumentation-cassandra-driver, npmGitHubnpm install @opentelemetry/instrumentation-cassandra-driver@0.66.0
  • 0.40.0@opentelemetry/instrumentation-tedious, npmGitHubnpm install @opentelemetry/instrumentation-tedious@0.40.0
  • 0.46.0@opentelemetry/instrumentation-oracledb, npmGitHubnpm install @opentelemetry/instrumentation-oracledb@0.46.0
  • 0.67.0@opentelemetry/instrumentation-mongoose, npmGitHubnpm install @opentelemetry/instrumentation-mongoose@0.67.0
  • 0.67.0@opentelemetry/instrumentation-mysql, npmGitHubnpm install @opentelemetry/instrumentation-mysql@0.67.0
  • 0.65.0@opentelemetry/instrumentation-knex, npmGitHubnpm install @opentelemetry/instrumentation-knex@0.65.0
Show all 8 fixed versions
  • 0.67.0@opentelemetry/instrumentation-mysql2, npmGitHubnpm install @opentelemetry/instrumentation-mysql2@0.67.0
  • 0.73.0@opentelemetry/instrumentation-pg, npmGitHubnpm install @opentelemetry/instrumentation-pg@0.73.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Multiple @opentelemetry/instrumentation-* packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it was the default behaviour for all users of the affected packages until the patched releases shipped on 2026-07-23.

The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention in use, the exported value may reveal:

  • Internal service account names that disclose architecture topology.
  • Role-encoded usernames (e.g. admin_readwrite, app_readonly_prod) useful for privilege inference.
  • Database account naming patterns useful for credential enumeration.

Affected packages (all are vulnerable from the first published version through the version listed below):

| Package | Vulnerable range | Patched version | |---------|-----------------|-----------------| | @opentelemetry/instrumentation-cassandra-driver | < 0.66.0 | 0.66.0 | | @opentelemetry/instrumentation-knex | < 0.65.0 | 0.65.0 | | @opentelemetry/instrumentation-mongoose | < 0.67.0 | 0.67.0 | | @opentelemetry/instrumentation-mysql | < 0.67.0 | 0.67.0 | | @opentelemetry/instrumentation-mysql2 | < 0.67.0 | 0.67.0 | | @opentelemetry/instrumentation-oracledb | < 0.46.0 | 0.46.0 | | @opentelemetry/instrumentation-pg | < 0.73.0 | 0.73.0 | | @opentelemetry/instrumentation-tedious | < 0.40.0 | 0.40.0 |

Patches

Fixed in the coordinated release on 2026-07-23 via feat!: only emit stable http, network and database attributes (#3585).

Upgrade to the patched version listed in the table above for each instrumentation package in use.

Workarounds

No configuration-level workaround exists in the affected versions: the db.user attribute cannot be suppressed without patching. As a partial mitigation, a custom SpanProcessor can be used to strip db.user from spans before they leave the process:

// Example: drop db.user in a custom SpanProcessor
class StripDbUserProcessor implements SpanProcessor {
  onStart(span: Span) {
    span.setAttribute('db.user', null);
  }
  onEnd() {}
  shutdown() { return Promise.resolve(); }
  forceFlush() { return Promise.resolve(); }
}

Users who control the downstream collector can also filter the attribute at the collector pipeline level.

Text from GitHub Advisory Database

Affected versions 25

  • @opentelemetry/instrumentation-cassandra-driver, npm< 0.66.0GitHub
  • @opentelemetry/instrumentation-tedious, npm< 0.40.0GitHub
  • @opentelemetry/instrumentation-oracledb, npm< 0.46.0GitHub
  • @opentelemetry/instrumentation-mongoose, npm< 0.67.0GitHub
  • @opentelemetry/instrumentation-mysql, npm< 0.67.0GitHub
  • @opentelemetry/instrumentation-knex, npm< 0.65.0GitHub
  • @opentelemetry/instrumentation-mysql2, npm< 0.67.0GitHub
  • @opentelemetry/instrumentation-pg, npm< 0.73.0GitHub
  • opentelemetry-js-contribaffected: < 27e172a9e0d549559056ccd58f27d13467454156CVE List
  • instrumentation-cassandra-driveraffected: < 0.66.0CVE List
  • instrumentation-knexaffected: < 0.65.0CVE List
  • instrumentation-mongooseaffected: < 0.67.0CVE List
  • instrumentation-mysqlaffected: < 0.67.0CVE List
  • instrumentation-mysql2affected: < 0.67.0CVE List
  • instrumentation-oracledbaffected: < 0.46.0CVE List
  • instrumentation-pgaffected: < 0.73.0CVE List
  • instrumentation-tediousaffected: < 0.40.0CVE List
  • @opentelemetry/instrumentation-cassandra-driver, npmfrom first release, fixed in 0.66.0OSV
  • @opentelemetry/instrumentation-tedious, npmfrom first release, fixed in 0.40.0OSV
  • @opentelemetry/instrumentation-oracledb, npmfrom first release, fixed in 0.46.0OSV
  • @opentelemetry/instrumentation-mongoose, npmfrom first release, fixed in 0.67.0OSV
  • @opentelemetry/instrumentation-mysql, npmfrom first release, fixed in 0.67.0OSV
  • @opentelemetry/instrumentation-knex, npmfrom first release, fixed in 0.65.0OSV
  • @opentelemetry/instrumentation-mysql2, npmfrom first release, fixed in 0.67.0OSV
  • @opentelemetry/instrumentation-pg, npmfrom first release, fixed in 0.73.0OSV

References 6