CVE-2026-104872: OpenTelemetry JavaScript Information Leak

CVE-2026-104872 Overview

CVE-2026-104872 affects multiple OpenTelemetry JavaScript Contrib instrumentation packages that collect telemetry from database client libraries. The packages add the database connection username to every instrumented database operation as the db.user span attribute. This attribute is emitted by default and is not gated by enhancedDatabaseReporting or any other opt-in flag. Observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. The issue is classified as [CWE-532] Insertion of Sensitive Information into Log File.

Critical Impact
Database usernames are leaked into telemetry spans sent to every configured observability backend, exposing account naming schemes and environment metadata to any party with access to collected traces.

Affected Products

@opentelemetry/instrumentation-cassandra-driver prior to 0.66.0, @opentelemetry/instrumentation-knex prior to 0.65.0, and @opentelemetry/instrumentation-mongoose prior to 0.67.0
@opentelemetry/instrumentation-mysql and @opentelemetry/instrumentation-mysql2 prior to 0.67.0, and @opentelemetry/instrumentation-oracledb prior to 0.46.0
@opentelemetry/instrumentation-pg prior to 0.73.0 and @opentelemetry/instrumentation-tedious prior to 0.40.0

Discovery Timeline

2026-10-02 - CVE-2026-104872 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104872

Vulnerability Analysis

The affected instrumentation packages wrap database client calls and emit OpenTelemetry spans describing each operation. During span creation, the instrumentation reads the username from the active database connection and attaches it as the db.user span attribute. The attribute is emitted on every instrumented call regardless of configuration. Operators who assume sensitive attributes require enhancedDatabaseReporting=true are affected without warning.

Usernames in production environments commonly encode service names, roles, and environment tiers. Examples include svc_billing_prod, readonly_reporting, or app_payments_eu. Once embedded in spans, these identifiers propagate to any sink in the telemetry pipeline, including shared SaaS observability platforms, log aggregators, and long-term trace archives. The disclosure undermines the assumption that trace data contains only operational metadata and not credential-adjacent identifiers.

Root Cause

The root cause is an insecure default in attribute emission logic. The instrumentation code reads connection metadata and unconditionally sets db.user on the span, rather than gating the attribute behind an opt-in flag like enhancedDatabaseReporting. This conflicts with OpenTelemetry semantic conventions that treat identity-adjacent attributes as sensitive by default.

Attack Vector

This is not a direct remote exploit. The exposure path is through legitimate telemetry collection. Any actor with read access to the observability backend, trace storage, or an intermediate collector can enumerate database account names across services. This information supports reconnaissance for credential stuffing, phishing targeting named service owners, and mapping of internal service topology.

typescript

// Patch excerpt: packages/instrumentation-amqplib/src/amqplib.ts
// feat!: only emit stable http, network and database attributes (#3585)
   InstrumentationNodeModuleFile,
   isWrapped,
   safeExecuteInTheMiddle,
-  SemconvStability,
-  semconvStabilityFromStr,
 } from '@opentelemetry/instrumentation';
 import { ATTR_MESSAGING_OPERATION } from './semconv';

Source: GitHub Commit Fix

The fix removes deprecated semantic convention attributes and aligns emission with the stable attribute set, which excludes db.user from default output.

Detection Methods for CVE-2026-104872

Indicators of Compromise

Presence of a db.user attribute on database client spans emitted by any affected @opentelemetry/instrumentation-* package at a vulnerable version.
Observability backend queries returning distinct database usernames grouped by service.name or deployment.environment.
Trace exports retained in third-party SaaS platforms that contain populated db.user fields.

Detection Strategies

Inventory running Node.js services and compare installed versions of the eight affected packages against the fixed releases.
Run a span query against your trace backend filtering for db.system in (postgresql, mysql, mongodb, cassandra, oracle, mssql) and checking for a non-empty db.user attribute.
Review collector pipeline configurations for attributes processors that could have stripped db.user; absence of such a processor indicates exposure.

Monitoring Recommendations

Add a continuous check that fails CI builds when a vulnerable package version is pinned in package-lock.json or yarn.lock.
Alert when new distinct values appear in the db.user span attribute dimension in your observability platform.
Audit backend access logs to identify third parties that queried traces containing db.user before remediation.

How to Mitigate CVE-2026-104872

Immediate Actions Required

Upgrade each affected package to the fixed version: instrumentation-cassandra-driver 0.66.0, instrumentation-knex 0.65.0, instrumentation-mongoose / instrumentation-mysql / instrumentation-mysql2 0.67.0, instrumentation-oracledb 0.46.0, instrumentation-pg 0.73.0, and instrumentation-tedious 0.40.0.
Purge or redact historical traces in observability backends that contain the db.user attribute, with priority on long-retention archives.
Rotate any database account whose name encodes information you consider sensitive, such as environment tier or privilege level.

Patch Information

The fixes are tracked in GitHub Pull Request #3585 and the primary commits 27e172a and 5b7dd0e. Full details are published in GitHub Security Advisory GHSA-qqmp-wf37-98f9.

Workarounds

Deploy an OpenTelemetry Collector attributes processor that deletes db.user from all spans before export.
Configure a span processor in application code that removes the db.user attribute before the span is finished.
Route telemetry through a self-hosted collector tier so that external SaaS backends never receive the attribute.

bash

# OpenTelemetry Collector config: strip db.user from all spans
processors:
  attributes/strip_db_user:
    actions:
      - key: db.user
        action: delete

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [attributes/strip_db_user, batch]
      exporters: [otlp]