CVE-2026-104872

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.

• CWE-532

• https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156
• https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037
• https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585
• https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9

Published

Oct 2, 2026

Last Modified

Oct 6, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104853Nx is a monorepo solution for TypeScript and polyglot codeba…5.8
• CVE-2026-104854Nx is a monorepo solution for TypeScript and polyglot codeba…8.5
• CVE-2026-104855Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.…2
• CVE-2026-104859Nx is a monorepo solution for TypeScript and polyglot codeba…7.3
• CVE-2026-104861probe-image-size gets image dimensions without downloading t…7.5
• CVE-2026-104871The Angular SSR is a server-rise rendering tool for Angular …6.3
• CVE-2026-104873LangGraph Python SDK is used to connect to running LangGraph…7.6
• CVE-2026-104874Multidict is an implementation of a multidict data structure…5.3
• CVE-2026-104875Ente provides end-to-end encrypted cloud services and securi…7.1
• CVE-2026-104886Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-104887Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-104890Kunstmaan CMS is an open source content management system ba…7.2