{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104872", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-02T14:59:11.775Z", "datePublished": "2026-10-02T19:50:24.868Z", "dateUpdated": "2026-10-06T16:40:55.440Z"}, "containers": {"cna": {"title": "Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute", "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"}, {"name": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585"}, {"name": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156"}, {"name": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"}], "affected": [{"vendor": "open-telemetry", "product": "opentelemetry-js-contrib", "versions": [{"version": "< 27e172a9e0d549559056ccd58f27d13467454156", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-cassandra-driver", "versions": [{"version": "< 0.66.0", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-knex", "versions": [{"version": "< 0.65.0", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-mongoose", "versions": [{"version": "< 0.67.0", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-mysql", "versions": [{"version": "< 0.67.0", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-mysql2", "versions": [{"version": "< 0.67.0", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-oracledb", "versions": [{"version": "< 0.46.0", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-pg", "versions": [{"version": "< 0.73.0", "status": "affected"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-tedious", "versions": [{"version": "< 0.40.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-02T19:50:24.868Z"}, "descriptions": [{"lang": "en", "value": "OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}], "source": {"advisory": "GHSA-qqmp-wf37-98f9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T16:40:46.354222Z", "id": "CVE-2026-104872", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T16:40:55.440Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-104872", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T16:40:46.354222Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T16:40:51.753Z"}}], "cna": {"title": "Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute", "source": {"advisory": "GHSA-qqmp-wf37-98f9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "open-telemetry", "product": "opentelemetry-js-contrib", "versions": [{"status": "affected", "version": "< 27e172a9e0d549559056ccd58f27d13467454156"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-cassandra-driver", "versions": [{"status": "affected", "version": "< 0.66.0"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-knex", "versions": [{"status": "affected", "version": "< 0.65.0"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-mongoose", "versions": [{"status": "affected", "version": "< 0.67.0"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-mysql", "versions": [{"status": "affected", "version": "< 0.67.0"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-mysql2", "versions": [{"status": "affected", "version": "< 0.67.0"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-oracledb", "versions": [{"status": "affected", "version": "< 0.46.0"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-pg", "versions": [{"status": "affected", "version": "< 0.73.0"}]}, {"vendor": "@opentelemetry", "product": "instrumentation-tedious", "versions": [{"status": "affected", "version": "< 0.40.0"}]}], "references": [{"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9", "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585", "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156", "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037", "name": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-02T19:50:24.868Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104872", "state": "PUBLISHED", "dateUpdated": "2026-10-06T16:40:55.440Z", "dateReserved": "2026-10-02T14:59:11.775Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-02T19:50:24.868Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "opentelemetry-js-contrib", "vendor": "open-telemetry", "versions": [{"status": "affected", "version": "< 27e172a9e0d549559056ccd58f27d13467454156"}]}, {"product": "instrumentation-cassandra-driver", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.66.0"}]}, {"product": "instrumentation-knex", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.65.0"}]}, {"product": "instrumentation-mongoose", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.67.0"}]}, {"product": "instrumentation-mysql", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.67.0"}]}, {"product": "instrumentation-mysql2", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.67.0"}]}, {"product": "instrumentation-oracledb", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.46.0"}]}, {"product": "instrumentation-pg", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.73.0"}]}, {"product": "instrumentation-tedious", "vendor": "@opentelemetry", "versions": [{"status": "affected", "version": "< 0.40.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages."}], "id": "CVE-2026-104872", "lastModified": "2026-10-06T17:17:16.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104872", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T16:40:46.354222Z", "version": "2.0.3"}}]}, "published": "2026-10-02T20:17:01.067", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156"}, {"source": "security-advisories@github.com", "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037"}, {"source": "security-advisories@github.com", "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585"}, {"source": "security-advisories@github.com", "url": "https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data", "id": "2545330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545330"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.", "A flaw was found in OpenTelemetry JavaScript Contrib database instrumentation packages. By default, these packages automatically attach database connection usernames to emitted telemetry traces during database operations without requiring explicit opt-in configuration. This issue allows unauthorized users with access to observability storage backends to view sensitive database usernames, resulting in information disclosure that exposes service topology, roles, and account naming conventions."], "mitigation": {"lang": "en:us", "value": "Update to fixed versions.\nWorkaround: a custom SpanProcessor can be used to strip db.user from spans before export."}, "name": "CVE-2026-104872", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-02T19:50:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104872\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104872\nhttps://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156\nhttps://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037\nhttps://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585\nhttps://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9"], "statement": "Some `@opentelemetry/instrumentation-*` packages unconditionally emitted the db.user span attribute (database connection username) on every instrumented database operation. This was default behaviour, not gated by any opt-in flag. The username is forwarded to all configured observability backends (Jaeger, Zipkin, Datadog, OTLP collectors), potentially revealing service account names, role-encoded usernames, and architecture topology.\nOnly usernames are leaked \u2014 no passwords, connection strings, or data.", "threat_severity": "Moderate"}