Vulnerability-Lookup

GHSA-QQMP-WF37-98F9

Vulnerability from github – Published: 2026-10-05 22:52 – Updated: 2026-10-05 22:52

Summary

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Details

Impact

Multiple @opentelemetry/instrumentation-* packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it was the default behaviour for all users of the affected packages until the patched releases shipped on 2026-07-23.

The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention in use, the exported value may reveal:

Internal service account names that disclose architecture topology.
Role-encoded usernames (e.g. admin_readwrite, app_readonly_prod) useful for privilege inference.
Database account naming patterns useful for credential enumeration.

Affected packages (all are vulnerable from the first published version through the version listed below):

Package	Vulnerable range	Patched version
`@opentelemetry/instrumentation-cassandra-driver`	`< 0.66.0`	`0.66.0`
`@opentelemetry/instrumentation-knex`	`< 0.65.0`	`0.65.0`
`@opentelemetry/instrumentation-mongoose`	`< 0.67.0`	`0.67.0`
`@opentelemetry/instrumentation-mysql`	`< 0.67.0`	`0.67.0`
`@opentelemetry/instrumentation-mysql2`	`< 0.67.0`	`0.67.0`
`@opentelemetry/instrumentation-oracledb`	`< 0.46.0`	`0.46.0`
`@opentelemetry/instrumentation-pg`	`< 0.73.0`	`0.73.0`
`@opentelemetry/instrumentation-tedious`	`< 0.40.0`	`0.40.0`

Patches

Fixed in the coordinated release on 2026-07-23 via feat!: only emit stable http, network and database attributes (#3585).

Upgrade to the patched version listed in the table above for each instrumentation package in use.

Workarounds

No configuration-level workaround exists in the affected versions: the db.user attribute cannot be suppressed without patching. As a partial mitigation, a custom SpanProcessor can be used to strip db.user from spans before they leave the process:

// Example: drop db.user in a custom SpanProcessor
class StripDbUserProcessor implements SpanProcessor {
  onStart(span: Span) {
    span.setAttribute('db.user', null);
  }
  onEnd() {}
  shutdown() { return Promise.resolve(); }
  forceFlush() { return Promise.resolve(); }
}

Users who control the downstream collector can also filter the attribute at the collector pipeline level.

Severity

5.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-cassandra-driver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.66.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-tedious"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.40.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-oracledb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.46.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-mongoose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.67.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-mysql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.67.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-knex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.65.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-mysql2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.67.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/instrumentation-pg"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.73.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104872"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:52:44Z",
    "nvd_published_at": "2026-10-02T20:17:01Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nMultiple `@opentelemetry/instrumentation-*` packages recorded the database connection username as the `db.user`\nspan attribute on every instrumented database operation. This attribute was emitted unconditionally \u2014 it was\nnot gated by `enhancedDatabaseReporting` or any other opt-in flag, and it was the **default** behaviour for\nall users of the affected packages until the patched releases shipped on 2026-07-23.\n\nThe attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP\ncollectors, etc.).  Depending on the database account naming convention in use, the exported value may\nreveal:\n\n- Internal service account names that disclose architecture topology.\n- Role-encoded usernames (e.g. `admin_readwrite`, `app_readonly_prod`) useful for privilege inference.\n- Database account naming patterns useful for credential enumeration.\n\nAffected packages (all are vulnerable from the first published version through the version listed below):\n\n| Package | Vulnerable range | Patched version |\n|---------|-----------------|-----------------|\n| `@opentelemetry/instrumentation-cassandra-driver` | `\u003c 0.66.0` | `0.66.0` |\n| `@opentelemetry/instrumentation-knex`             | `\u003c 0.65.0` | `0.65.0` |\n| `@opentelemetry/instrumentation-mongoose`         | `\u003c 0.67.0` | `0.67.0` |\n| `@opentelemetry/instrumentation-mysql`            | `\u003c 0.67.0` | `0.67.0` |\n| `@opentelemetry/instrumentation-mysql2`           | `\u003c 0.67.0` | `0.67.0` |\n| `@opentelemetry/instrumentation-oracledb`         | `\u003c 0.46.0` | `0.46.0` |\n| `@opentelemetry/instrumentation-pg`               | `\u003c 0.73.0` | `0.73.0` |\n| `@opentelemetry/instrumentation-tedious`          | `\u003c 0.40.0` | `0.40.0` |\n\n### Patches\n\nFixed in the coordinated release on 2026-07-23 via\n[feat!: only emit stable http, network and database attributes (#3585)](https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585).\n\nUpgrade to the patched version listed in the table above for each instrumentation package in use.\n\n### Workarounds\n\nNo configuration-level workaround exists in the affected versions: the `db.user` attribute cannot be\nsuppressed without patching. As a partial mitigation, a custom `SpanProcessor` can be used to strip `db.user` from spans before they leave the process:\n\n```ts\n// Example: drop db.user in a custom SpanProcessor\nclass StripDbUserProcessor implements SpanProcessor {\n  onStart(span: Span) {\n    span.setAttribute(\u0027db.user\u0027, null);\n  }\n  onEnd() {}\n  shutdown() { return Promise.resolve(); }\n  forceFlush() { return Promise.resolve(); }\n}\n```\n\nUsers who control the downstream collector can also filter the attribute at the collector pipeline level.",
  "id": "GHSA-qqmp-wf37-98f9",
  "modified": "2026-10-05T22:52:44Z",
  "published": "2026-10-05T22:52:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104872"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-js-contrib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"
}

CVE-2026-104872 (GCVE-0-2026-104872)

Vulnerability from cvelistv5 – Published: 2026-10-02 19:50 – Updated: 2026-10-02 19:50

Title

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Summary

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC

Impacted products

9 products

Vendor	Product	Version
open-telemetry	opentelemetry-js-contrib	Affected: < 27e172a9e0d549559056ccd58f27d13467454156
@opentelemetry	instrumentation-cassandra-driver	Affected: < 0.66.0
@opentelemetry	instrumentation-knex	Affected: < 0.65.0
@opentelemetry	instrumentation-mongoose	Affected: < 0.67.0
@opentelemetry	instrumentation-mysql	Affected: < 0.67.0
@opentelemetry	instrumentation-mysql2	Affected: < 0.67.0
@opentelemetry	instrumentation-oracledb	Affected: < 0.46.0
@opentelemetry	instrumentation-pg	Affected: < 0.73.0
@opentelemetry	instrumentation-tedious	Affected: < 0.40.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-js-contrib",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 27e172a9e0d549559056ccd58f27d13467454156"
            }
          ]
        },
        {
          "product": "instrumentation-cassandra-driver",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.66.0"
            }
          ]
        },
        {
          "product": "instrumentation-knex",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.65.0"
            }
          ]
        },
        {
          "product": "instrumentation-mongoose",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.67.0"
            }
          ]
        },
        {
          "product": "instrumentation-mysql",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.67.0"
            }
          ]
        },
        {
          "product": "instrumentation-mysql2",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.67.0"
            }
          ]
        },
        {
          "product": "instrumentation-oracledb",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.46.0"
            }
          ]
        },
        {
          "product": "instrumentation-pg",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.73.0"
            }
          ]
        },
        {
          "product": "instrumentation-tedious",
          "vendor": "@opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.40.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T19:50:24.868Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"
        }
      ],
      "source": {
        "advisory": "GHSA-qqmp-wf37-98f9",
        "discovery": "UNKNOWN"
      },
      "title": "Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104872",
    "datePublished": "2026-10-02T19:50:24.868Z",
    "dateReserved": "2026-10-02T14:59:11.775Z",
    "dateUpdated": "2026-10-02T19:50:24.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted