CVE-2026-104872: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Multiple @opentelemetry/instrumentation-* packages recorded the database connection username as the db.user
span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was
not gated by enhancedDatabaseReporting or any other opt-in flag, and it was the default behaviour for
all users of the affected packages until the patched releases shipped on 2026-07-23.
The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention in use, the exported value may reveal:
- Internal service account names that disclose architecture topology.
- Role-encoded usernames (e.g.
admin_readwrite,app_readonly_prod) useful for privilege inference. - Database account naming patterns useful for credential enumeration.
Affected packages (all are vulnerable from the first published version through the version listed below):
| Package | Vulnerable range | Patched version |
|---|---|---|
@opentelemetry/instrumentation-cassandra-driver | < 0.66.0 | 0.66.0 |
@opentelemetry/instrumentation-knex | < 0.65.0 | 0.65.0 |
@opentelemetry/instrumentation-mongoose | < 0.67.0 | 0.67.0 |
@opentelemetry/instrumentation-mysql | < 0.67.0 | 0.67.0 |
@opentelemetry/instrumentation-mysql2 | < 0.67.0 | 0.67.0 |
@opentelemetry/instrumentation-oracledb | < 0.46.0 | 0.46.0 |
@opentelemetry/instrumentation-pg | < 0.73.0 | 0.73.0 |
@opentelemetry/instrumentation-tedious | < 0.40.0 | 0.40.0 |
References
- github.com/advisories/GHSA-qqmp-wf37-98f9
- github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156
- github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037
- github.com/open-telemetry/opentelemetry-js-contrib/pull/3585
- github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9
- nvd.nist.gov/vuln/detail/CVE-2026-104872
Code Behaviors & Features
Detect and mitigate CVE-2026-104872 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →