OpenTelemetry JavaScript Contrib packages emit the database connection username on every instrumented operation as a db.user span attribute by default. The attribute is not gated by any opt‑in flag, so observability backends that receive the telemetry will automatically include these usernames. The unintended leakage of account names can reveal service topology, database roles, environment details, and naming conventions that could aid an attacker in planning or executing further attacks. The weakness is a form of log or telemetry data exposure and is classified by the CWE list as CWE‑532 and CWE‑201.

Affected products include the @opentelemetry instrumentation packages for Cassandra, Knex, Mongoose, MySQL, MySQL2, OracleDB, PostgreSQL, and Tedious, as well as the opentelemetry‑js‑contrib repository. The vulnerable versions are @opentelemetry/instrumentation-cassandra-driver prior to 0.66.0, @opentelemetry/instrumentation-knex prior to 0.65.0, @opentelemetry/instrumentation-mongoose prior to 0.67.0, @opentelemetry/instrumentation-mysql and @opentelemetry/instrumentation-mysql2 prior to 0.67.0, @opentelemetry/instrumentation-oracledb prior to 0.46.0, @opentelemetry/instrumentation-pg prior to 0.73.0, and @opentelemetry/instrumentation-tedious prior to 0.40.0.

The CVSS score for this issue is 5.8, placing it in the medium severity range. The EPSS score is 0.00244, indicating a very low likelihood of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is an attacker with access to the telemetry stream or backend logs; from there they can read the exposed usernames. The impact is primarily informational leakage rather than direct code execution or denial of service, but the disclosed credentials could assist in privilege escalation weaknesses.