Instrumentation Cassandra Driver
Monthly
Database account usernames are silently emitted into telemetry traces by the OpenTelemetry JavaScript Contrib database instrumentation packages, which attach the `db.user` span attribute to every instrumented database operation by default, independent of the `enhancedDatabaseReporting` opt-in setting. Every deployment running the affected packages below their fixed versions - @opentelemetry/instrumentation-cassandra-driver before 0.66.0, -knex before 0.65.0, -mongoose/-mysql/-mysql2 before 0.67.0, -oracledb before 0.46.0, -pg before 0.73.0, and -tedious before 0.40.0 - that exports traces to a shared observability backend therefore leaks its database usernames, and indirectly hints about service topology, role assignment, and environment naming, to any actor with read access to that telemetry pipeline. Scored CVSS 5.8 (CWE-532), this is a default-configuration information-disclosure weakness rather than a remotely triggerable attacker compromise: no public exploit code has been identified at time of analysis, there is no confirmed active exploitation, and the only credential material exposed is account names - not passwords, query contents, or result data.
Database account usernames are silently emitted into telemetry traces by the OpenTelemetry JavaScript Contrib database instrumentation packages, which attach the `db.user` span attribute to every instrumented database operation by default, independent of the `enhancedDatabaseReporting` opt-in setting. Every deployment running the affected packages below their fixed versions - @opentelemetry/instrumentation-cassandra-driver before 0.66.0, -knex before 0.65.0, -mongoose/-mysql/-mysql2 before 0.67.0, -oracledb before 0.46.0, -pg before 0.73.0, and -tedious before 0.40.0 - that exports traces to a shared observability backend therefore leaks its database usernames, and indirectly hints about service topology, role assignment, and environment naming, to any actor with read access to that telemetry pipeline. Scored CVSS 5.8 (CWE-532), this is a default-configuration information-disclosure weakness rather than a remotely triggerable attacker compromise: no public exploit code has been identified at time of analysis, there is no confirmed active exploitation, and the only credential material exposed is account names - not passwords, query contents, or result data.