CVE-2026-104872

About vulnerability

Impact

Multiple @opentelemetry/instrumentation-* packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it was the default behaviour for all users of the affected packages until the patched releases shipped on 2026-07-23.

The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention in use, the exported value may reveal:

• Internal service account names that disclose architecture topology.
• Role-encoded usernames (e.g. admin_readwrite, app_readonly_prod) useful for privilege inference.
• Database account naming patterns useful for credential enumeration.

Affected packages (all are vulnerable from the first published version through the version listed below):

Patches

Fixed in the coordinated release on 2026-07-23 via [feat!: only emit stable http, network and database attributes (#3585)](https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585).

Upgrade to the patched version listed in the table above for each instrumentation package in use.

Workarounds

No configuration-level workaround exists in the affected versions: the db.user attribute cannot be suppressed without patching. As a partial mitigation, a custom SpanProcessor can be used to strip db.user from spans before they leave the process:

// Example: drop db.user in a custom SpanProcessor
class StripDbUserProcessor implements SpanProcessor {
onStart(span: Span) {
span.setAttribute('db.user', null);
}
onEnd() {}
shutdown() { return Promise.resolve(); }
forceFlush() { return Promise.resolve(); }
}

Users who control the downstream collector can also filter the attribute at the collector pipeline level.

Affected product:

graphql-hive-plugin-opentelemetry , graphql-inspector , graphql-inspector-ci , graphql-inspector-git-loader , graphql-inspector-graphql-loader , graphql-inspector-url-loader , inngest , lighthouse , opentelemetry-auto-instrumentations-node , opentelemetry-instrumentation-cassandra-driver , opentelemetry-instrumentation-knex , opentelemetry-instrumentation-mongoose , opentelemetry-instrumentation-mysql , opentelemetry-instrumentation-mysql2 , opentelemetry-instrumentation-oracledb , opentelemetry-instrumentation-pg , opentelemetry-instrumentation-tedious , probot , probot/pino , sentry-astro , sentry-aws-serverless , sentry-browser , sentry-bun , sentry-core , sentry-deno , sentry-electron , sentry-ember , sentry-gatsby , sentry-google-cloud-serverless , sentry-javascript , sentry-nestjs , sentry-nextjs , sentry-node , sentry-node-native , sentry-nuxt , sentry-profiling-node , sentry-react-router , sentry-remix , sentry-replay , sentry-solid , sentry-solidstart , sentry-sveltekit , sentry-tanstackstart , sentry-tanstackstart-react , sentry-types , sentry-wasm

Affected packages:

@opentelemetry/instrumentation-mysql2 @ 0.59.0 (+377 more)