CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
OpenTelemetry instrumentation libraries leak database usernames in span attributes by default, exposing sensitive account information to observability backends.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104872?
CVE-2026-104872 is a medium-severity vulnerability in @opentelemetry instrumentation-cassandra-driver, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
Weakness: CWE-532
Which versions are affected by CVE-2026-104872?
16 open source packages ship an affected version, including @opentelemetry/instrumentation-cassandra-driver, @opentelemetry/instrumentation-knex and @opentelemetry/instrumentation-mongoose.
| Package | Affected | Fixed in |
|---|---|---|
@opentelemetry/instrumentation-cassandra-driver npm | All versions | 0.66.0 |
@opentelemetry/instrumentation-cassandra-driver npm | All versions | 0.66.0 |
@opentelemetry/instrumentation-knex npm | All versions | 0.65.0 |
@opentelemetry/instrumentation-knex npm | All versions | 0.65.0 |
@opentelemetry/instrumentation-mongoose npm | All versions | 0.67.0 |
@opentelemetry/instrumentation-mongoose npm | All versions | 0.67.0 |
10 more packages
@opentelemetry/instrumentation-mysql npm | All versions | 0.67.0 |
@opentelemetry/instrumentation-mysql npm | All versions | 0.67.0 |
@opentelemetry/instrumentation-mysql2 npm | All versions | 0.67.0 |
@opentelemetry/instrumentation-mysql2 npm | All versions | 0.67.0 |
@opentelemetry/instrumentation-oracledb npm | All versions | 0.46.0 |
@opentelemetry/instrumentation-oracledb npm | All versions | 0.46.0 |
@opentelemetry/instrumentation-pg npm | All versions | 0.73.0 |
@opentelemetry/instrumentation-pg npm | All versions | 0.73.0 |
@opentelemetry/instrumentation-tedious npm | All versions | 0.40.0 |
@opentelemetry/instrumentation-tedious npm | All versions | 0.40.0 |
How do I fix CVE-2026-104872?
Upgrade @opentelemetry/instrumentation-cassandra-driver to 0.66.0 or later.
Is CVE-2026-104872 being exploited?
There is no known exploitation of CVE-2026-104872 in the wild and no public exploit code.
Sources
Also known as ECHO-980f-e1f1-2a12, GHSA-qqmp-wf37-98f9, MINI-2v4g-5fjf-cwfc, MINI-4x6f-6fv6-5pw8, MINI-5532-3695-jhqr, MINI-722w-68j5-9jpr and 5 more.