CVE-2026-104872 describes a vulnerability in the OpenTelemetry JavaScript Contrib instrumentation libraries where the database connection username is inserted into telemetry span attributes (db.user) for every instrumented database operation. This attribute is emitted by default without an opt-in setting, causing sensitive database account names to be exposed to configured observability backends. The affected packages include @opentelemetry/instrumentation-cassandra-driver, instrumentation-knex, instrumentation-mongoose, instrumentation-mysql, instrumentation-mysql2, instrumentation-oracledb, instrumentation-pg, and instrumentation-tedious. The vulnerability is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 respectively.

The vulnerability results in the exposure of database usernames in telemetry data sent to observability backends. This can reveal sensitive information about service topology, roles, environment, and account naming conventions. There is no direct impact on data integrity or availability, and no known exploits in the wild. The confidentiality impact is limited to the exposure of usernames, which may aid an attacker in reconnaissance but does not directly compromise database credentials or data.

A fix is available in the specified versions of the affected OpenTelemetry instrumentation packages. Users should upgrade to at least versions 0.66.0 for @opentelemetry/instrumentation-cassandra-driver, 0.65.0 for instrumentation-knex, 0.67.0 for instrumentation-mongoose, instrumentation-mysql, and instrumentation-mysql2, 0.46.0 for instrumentation-oracledb, 0.73.0 for instrumentation-pg, and 0.40.0 for instrumentation-tedious. Upgrading these packages will prevent the default emission of the database username in telemetry span attributes.