fkie_cve-2026-104872

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.

GHSA-qqmp-wf37-98f9 — Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Affected: npm: @opentelemetry/instrumentation-cassandra-driver, npm: @opentelemetry/instrumentation-tedious, npm: @opentelemetry/instrumentation-oracledb, npm: @opentelemetry/instrumentation-mongoose, npm: @opentelemetry/instrumentation-mysql, npm: @opentelemetry/instrumentation-knex, npm: @opentelemetry/instrumentation-mysql2, npm: @opentelemetry/instrumentation-pg

### Impact

Multiple `@opentelemetry/instrumentation-*` packages recorded the database connection username as the `db.user` span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by `enhancedDatabaseReporting` or any other opt-in flag, and it was the **default** behaviour for all users of the affected packages until the patched releases shipped on 2026-07-23.

The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention in use, the exported value may reveal:

- Internal service account names that disclose architecture topology. - Role-encoded usernames (e.g. `admin_readwrite`, `app_readonly_prod`) useful for privilege inference. - Database account naming patterns useful for credential enumeration.

Affected packages (all are vulnerable from the first published version through the version listed below):

| Package | Vulnerable range | Patched version | |---------|-----------------|-----------------| | `@opentelemetry/instrumentation-cassandra-driver` | `< 0.66.0` | `0.66.0` | | `@opentelemetry/instrumentation-knex` | `< 0.65.0` | `0.65.0` | | `@opentelemetry/instrumentation-mongoose` | `< 0.67.0` | `0.67.0` | | `@opentelemetry/instrumentation-mysql` | `< 0.67.0` | `0.67.0` | | `@opentelemetry/instrumentation-mysql2` | `< 0.67.0` | `0.67.0` | | `@opentelemetry/inst…

Most recent entries from all

fkie_cve-2026-104872

GHSA-qqmp-wf37-98f9 — Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute