{"schemaVersion":3,"id":"CVE-2026-104872","aliases":["GHSA-qqmp-wf37-98f9","CGA-246v-4f9g-g95p","CGA-25p6-hmcp-pg7x","CGA-2c75-76cf-gr75","CGA-2fjr-9m5m-c52m","CGA-2j33-5vmf-2ww4","CGA-3676-fq8x-pgjw","CGA-38gx-m85r-c87f","CGA-3cpq-c32r-3fr7","CGA-3gmq-29cx-64wg","CGA-3mpx-qwfq-g6v8","CGA-3ph8-xxf2-fhjg","CGA-3q6f-5349-rjc5","CGA-3vw3-hxcv-3g3g","CGA-3xjj-c5cr-gwhg","CGA-42rj-7h2x-ffw8","CGA-4pw5-8xwr-xhx3","CGA-4vwx-9xj4-74fh","CGA-536g-86w2-8f5w","CGA-5482-fqc4-7rrf","CGA-56c5-c67x-v4rw","CGA-5f68-m6c3-4j9v","CGA-5mpc-rf5w-x57w","CGA-5p5w-rqhg-24gj","CGA-5pgr-xc8c-hwf9","CGA-5x3f-v92r-jv35","CGA-5x48-8jxr-fxpg","CGA-62x2-rpj6-w2rx","CGA-64r9-496j-ph39","CGA-6wfj-wq2g-2wjq","CGA-6x3c-37p6-c5qv","CGA-7664-qc4x-2frh","CGA-7cqq-78cj-pw2q","CGA-7rcc-rj2r-qqxq","CGA-87g4-m4cw-5wqq","CGA-87gh-7v28-wgrm","CGA-8c36-wqx5-qmrg","CGA-8jqh-8gwf-gr3g","CGA-8mc2-gfvg-qvc9","CGA-8pgv-j49q-gj66","CGA-99xw-rh5r-29w6","CGA-9c9m-9v3w-8p9f","CGA-9gg3-949q-g7q9","CGA-9jc8-8m3v-69ch","CGA-9pj2-wpf7-fcg2","CGA-9pmv-p6jj-qr68","CGA-9xhc-29wp-6mr2","CGA-c2qw-rrjc-vmc2","CGA-c7h8-rff9-c2gf","CGA-c7jj-qvx4-83jg","CGA-c8v5-3hh4-m65g","CGA-c969-45pv-hxqq","CGA-cm66-qffj-p8qv","CGA-cwqj-fj75-m33p","CGA-f53j-gh8r-3xqh","CGA-f9qv-g5ch-v8xq","CGA-fc7m-9hwg-fhhj","CGA-fcwq-jvcx-g84m","CGA-ff5v-jrmv-pm2v","CGA-fjg4-cx4r-gpjh","CGA-fjh7-p44r-5qg9","CGA-fjmf-4vm2-fxm6","CGA-frhj-fhw6-4gp4","CGA-gcj8-wrjf-5xv8","CGA-gh97-qcxx-vjhm","CGA-gj2h-pf84-w5mw","CGA-gm32-gvx8-rcg3","CGA-gvvc-968j-6v28","CGA-gwwv-hw6c-396w","CGA-gx4r-hhqx-77xg","CGA-h2vx-cgf3-946h","CGA-h354-9429-mj2f","CGA-h55j-wqg6-mhmr","CGA-h74w-m849-cv6v","CGA-h87j-v6jf-2p5v","CGA-h8cq-hhp5-jvqr","CGA-h964-637f-pj48","CGA-h99v-fhx6-9x55","CGA-h9pq-gqjw-rvhj","CGA-hh73-v485-65c8","CGA-j244-wp25-3rgh","CGA-j45q-jrq8-6xx5","CGA-j6m8-fq86-2cg2","CGA-jg82-32rg-x8m8","CGA-jx5w-w28r-9f4r","CGA-m448-9x7p-7ghm","CGA-m68x-9hv3-2f4f","CGA-mvrg-fqx4-vcmm","CGA-mxc9-prw9-p792","CGA-pqpv-4xgq-c82p","CGA-pqrc-6fvv-pqhw","CGA-pr4g-8889-qr24","CGA-r6ff-g33f-qvj9","CGA-rw55-r86j-q9c6","CGA-vx3p-f888-p8x3","CGA-w9c2-89fc-cqqc","CGA-pxvg-34f4-mm5r","CGA-q3mc-5w73-7p3q","CGA-q4p8-547w-37q7","CGA-qgxg-x9qh-68p6","CGA-qvcx-4jf8-p4j5","CGA-r4mm-f39f-r3qf","CGA-r634-mm6r-2hr3","CGA-r6vp-8rr9-m6jf","CGA-r889-pccp-qjcw","CGA-rh27-hgwg-hm3j","CGA-rpwr-cq4f-j8j3","CGA-rqv8-2g92-4qcp","CGA-rvwf-5f8w-f8j5","CGA-v8gv-wh72-8mh4","CGA-vh2m-6j86-j58f","CGA-vm38-vm4f-gg42","CGA-w4wg-g4v6-qh53","CGA-w6pv-95jr-gcph","CGA-w8x9-g278-h2cc","CGA-x5ww-h383-939r","CGA-x8wf-jf43-wjv9","CGA-xf49-6rqx-m585","CGA-xfmg-pr7g-jjhj","CGA-xh2h-h3q7-4765","CGA-xrm4-pwh6-gw94"],"status":"published","duplicateOf":null,"title":null,"description":"OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.","dates":{"published":"2026-10-02T19:50:24.868Z","modified":"2026-10-06T16:40:55.440Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.8,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00244,"percentile":0.14732,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-03T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00244,"percentile":0.14732}],"last30":[{"date":"2026-10-03T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00244,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00244,"percentile":0.14732}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File","description":"The product writes sensitive information to a log file.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/532.html"}],"affected":[{"vendor":"chainguard","product":"azurite","name":"azurite","label":"azurite","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/azurite","purlType":"apk","versions":[{"text":"< 3.37.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.37.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.23-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.23-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.23-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.23-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 9.4.7-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 9.4.7-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.5","name":"kibana-9.5","label":"kibana-9.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.5","purlType":"apk","versions":[{"text":"< 9.5.4-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.5.4-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.8-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.8-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zitadel-4-login","name":"zitadel-4-login","label":"zitadel-4-login","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zitadel-4-login","purlType":"apk","versions":[{"text":"< 4.19.4-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.19.4-r2","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-cassandra-driver","name":"@opentelemetry/instrumentation-cassandra-driver","label":"instrumentation-cassandra-driver","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-cassandra-driver","purlType":"npm","versions":[{"text":"< 0.66.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.66.0","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-knex","name":"@opentelemetry/instrumentation-knex","label":"instrumentation-knex","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-knex","purlType":"npm","versions":[{"text":"< 0.65.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.65.0","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-mongoose","name":"@opentelemetry/instrumentation-mongoose","label":"instrumentation-mongoose","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-mongoose","purlType":"npm","versions":[{"text":"< 0.67.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.0","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-mysql","name":"@opentelemetry/instrumentation-mysql","label":"instrumentation-mysql","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-mysql","purlType":"npm","versions":[{"text":"< 0.67.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.0","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-mysql2","name":"@opentelemetry/instrumentation-mysql2","label":"instrumentation-mysql2","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-mysql2","purlType":"npm","versions":[{"text":"< 0.67.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.0","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-oracledb","name":"@opentelemetry/instrumentation-oracledb","label":"instrumentation-oracledb","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-oracledb","purlType":"npm","versions":[{"text":"< 0.46.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.46.0","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-pg","name":"@opentelemetry/instrumentation-pg","label":"instrumentation-pg","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-pg","purlType":"npm","versions":[{"text":"< 0.73.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.73.0","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"instrumentation-tedious","name":"@opentelemetry/instrumentation-tedious","label":"instrumentation-tedious","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/instrumentation-tedious","purlType":"npm","versions":[{"text":"< 0.40.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.40.0","eol":null,"hubHref":null},{"vendor":"open-telemetry","product":"opentelemetry-js-contrib","name":"opentelemetry-js-contrib","label":"opentelemetry-js-contrib","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 27e172a9e0d549559056ccd58f27d13467454156","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27e172a9e0d549559056ccd58f27d13467454156","eol":null,"hubHref":"/vendor/open-telemetry/opentelemetry-js-contrib"},{"vendor":"@opentelemetry","product":"instrumentation-cassandra-driver","name":"instrumentation-cassandra-driver","label":"instrumentation-cassandra-driver","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.66.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.66.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-cassandra-driver"},{"vendor":"@opentelemetry","product":"instrumentation-knex","name":"instrumentation-knex","label":"instrumentation-knex","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.65.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.65.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-knex"},{"vendor":"@opentelemetry","product":"instrumentation-mongoose","name":"instrumentation-mongoose","label":"instrumentation-mongoose","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.67.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-mongoose"},{"vendor":"@opentelemetry","product":"instrumentation-mysql","name":"instrumentation-mysql","label":"instrumentation-mysql","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.67.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-mysql"},{"vendor":"@opentelemetry","product":"instrumentation-mysql2","name":"instrumentation-mysql2","label":"instrumentation-mysql2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.67.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.67.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-mysql2"},{"vendor":"@opentelemetry","product":"instrumentation-oracledb","name":"instrumentation-oracledb","label":"instrumentation-oracledb","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.46.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.46.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-oracledb"},{"vendor":"@opentelemetry","product":"instrumentation-pg","name":"instrumentation-pg","label":"instrumentation-pg","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.73.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.73.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-pg"},{"vendor":"@opentelemetry","product":"instrumentation-tedious","name":"instrumentation-tedious","label":"instrumentation-tedious","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.40.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.40.0","eol":null,"hubHref":"/vendor/opentelemetry/instrumentation-tedious"}],"affectedCount":26,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","label":"github.com/open-telemetry/opentelemetry-js-contrib/security/advisories/GHSA-qqmp-wf37-98f9","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","label":"github.com/open-telemetry/opentelemetry-js-contrib/pull/3585","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","label":"github.com/open-telemetry/opentelemetry-js-contrib/commit/27e172a9e0d549559056ccd58f27d13467454156","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","label":"github.com/open-telemetry/opentelemetry-js-contrib/commit/5b7dd0e102e940d653e04b08b5a1b721a8271037","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104872","label":"nvd.nist.gov/vuln/detail/CVE-2026-104872","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-js-contrib","label":"github.com/open-telemetry/opentelemetry-js-contrib","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104872.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104872.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-02T19:50:24.868Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-06T16:40:55.440Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":23,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T19:19:28.644Z","stale":false,"partial":false}}