Medium, CVSS 5.8npmAmendedPublished
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
CVE-2026-104872 · GHSA-qqmp-wf37-98f9
- Affected
- npm @opentelemetry/instrumentation-pg < 0.73.0
- Fixed in
- 0.73.0· Vendor fix available
- Issue
- Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it was the default behaviour for all users of the affected packages until the patched releases shipped on 2026-07-23. The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention in use, the exported value may reveal: - Internal service account names that disclose architecture topology. - Role-encoded usernames (e.g. adminreadwrite, appreadonlyprod) useful for privilege inference. - Database account naming patterns useful for credential enumeration. Affected packages (all are vulnerable from the first published version through the version listed below): | Package | Vulnerable range |…
Recommended action: Upgrade to 0.73.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.