OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from
    JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver,
    0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose,
    @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of
    @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of
    @opentelemetry/instrumentation-tedious, the packages add the database connection username to every
    instrumented database operation as the db.user span attribute. The attribute is emitted by default and is
    not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends
    therefore receive database account names that may expose service topology, role or environment
    information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0,
    0.73.0, and 0.40.0 of the respective packages. (CVE-2026-104872)

ID	Name	Product	Family	Type	Severity
473566	Echo: @opentelemetry/instrumentation-cassandra-driver: security update to 0.40.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473566	Echo: @opentelemetry/instrumentation-cassandra-driver: security update to 0.40.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473520	Chainguard: librechat: security update to 0.8.8-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473520	Chainguard: librechat: security update to 0.8.8-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
473015	SCA: security update for @opentelemetry/instrumentation-cassandra-driver, @opentelemetry/instrumentation-knex, @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, @opentelemetry/instrumentation-mysql2, @opentelemetry/instrumentation-oracledb, @opentelemetry/instrumentation-pg, @opentelemetry/instrumentation-tedious (GHSA-qqmp-wf37-98f9)	Tenable Cloud Security	SCA Checks	Local	medium
473015	SCA: security update for @opentelemetry/instrumentation-cassandra-driver, @opentelemetry/instrumentation-knex, @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, @opentelemetry/instrumentation-mysql2, @opentelemetry/instrumentation-oracledb, @opentelemetry/instrumentation-pg, @opentelemetry/instrumentation-tedious (GHSA-qqmp-wf37-98f9)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-104872

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium