Database Connection User Exposure in OpenTelemetry JavaScript Instrumentation
CVE-2026-104872

5.8MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-js-contrib
Instrumentation-cassandra-driver
Instrumentation-knex
Instrumentation-mongoose
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104872?

The OpenTelemetry JavaScript Contrib libraries prior to specified versions expose database connection usernames during telemetry operations. This vulnerability can lead to the unintended disclosure of sensitive information, such as service topology and account naming patterns, to observability backends. It is essential to upgrade to the latest versions to mitigate these risks and ensure that sensitive data is not inadvertently shared.

Affected Version(s)

instrumentation-cassandra-driver < 0.66.0

instrumentation-knex < 0.65.0

instrumentation-mongoose < 0.67.0

References

https://github.com/open-telemetry/opentelemetry-js-contri...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-js-contri...
x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-js-contri...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.