Get real-time updates on Telegram
P4Verified
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
CVE-2026-104872 affects @opentelemetry/instrumentation-cassandra-driver. CVSS base score 5.8 (GitHub Advisory Database). EPSS 0.00244 (percentile 0.14191), scored 2026-10-04. Affected range: < 0.66.0. Fixed version: 0.66.0. Affected range: < 0.40.0. Fixed version: 0.40.0. Affected range: < 0.46.0. Fixed version: 0.46.0. Affected range: < 0.67.0. Fixed version: 0.67.0. Affected range: < 0.67.0. Fixed version: 0.67.0. Affected range: < 0.65.0. Fixed version: 0.65.0. Affected range: < 0.67.0. Fixed version: 0.67.0. Affected range: < 0.73.0. Fixed version: 0.73.0.
- CVE
- CVE-2026-104872
- Product
- @opentelemetry/instrumentation-cassandra-driver
- CCR priority
- 23.3 /100 (P4)
- CVSS
- 5.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N · GitHub Advisory Database
- EPSS
- 0.00244 · percentile 0.14191 · 2026-10-04
- KEV
- no
Affected products
- @opentelemetry/instrumentation-cassandra-driver · < 0.66.0 · Fixed version: 0.66.0
- @opentelemetry/instrumentation-tedious · < 0.40.0 · Fixed version: 0.40.0
- @opentelemetry/instrumentation-oracledb · < 0.46.0 · Fixed version: 0.46.0
- @opentelemetry/instrumentation-mongoose · < 0.67.0 · Fixed version: 0.67.0
- @opentelemetry/instrumentation-mysql · < 0.67.0 · Fixed version: 0.67.0
- @opentelemetry/instrumentation-knex · < 0.65.0 · Fixed version: 0.65.0
- @opentelemetry/instrumentation-mysql2 · < 0.67.0 · Fixed version: 0.67.0
- @opentelemetry/instrumentation-pg · < 0.73.0 · Fixed version: 0.73.0
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-104872.html