Vendor

@opentelemetry

3 known vulnerabilities.

Products

exporter-prometheus 1 sdk-node 1 auto-instrumentations-node 1 instrumentation-cassandra-driver 1 instrumentation-knex 1 instrumentation-mongoose 1 instrumentation-mysql 1 instrumentation-mysql2 1 instrumentation-oracledb 1 instrumentation-pg 1 instrumentation-tedious 1 opentelemetry-exporter-otlp-proto-http 1

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 6.5

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can …

@opentelemetry opentelemetry-exporter-otlp-proto-http python-opentelemetry python-opentelemetry Debian Ubuntu

Oct 18, 2026
Medium 5.8

CVE-2026-104872

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @o…

open-telemetry @opentelemetry instrumentation-oracledb instrumentation-tedious npm

Oct 2, 2026