CVE-2026-104872
CVE-2026-104872 updated by NVD
Summary
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| npm | @opentelemetry/instrumentation-cassandra-driver | — | 0.66.0 |
| npm | @opentelemetry/instrumentation-knex | — | 0.65.0 |
| npm | @opentelemetry/instrumentation-mongoose | — | 0.67.0 |
| npm | @opentelemetry/instrumentation-mysql | — | 0.67.0 |
| npm | @opentelemetry/instrumentation-mysql2 | — | 0.67.0 |
| npm | @opentelemetry/instrumentation-oracledb | — | 0.46.0 |
| npm | @opentelemetry/instrumentation-pg | — | 0.73.0 |
| npm | @opentelemetry/instrumentation-tedious | — | 0.40.0 |
Remediation: Upgrade to 0.66.0 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.