@OPENTELEMETRY/INSTRUMENTATION-HTTP · CVE-2026-128080 · Package
FIX → 0.222.0
The @opentelemetry/instrumentation-http package redacts sensitive query parameters on outgoing spans but writes raw query strings from incoming server requests into traces. An attacker with read access to the tracing backend can recover still-valid credentials such as presigned S3/GCS signatures or Azure SAS tokens.
first public Nov 9, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Node.js service instrumented with @opentelemetry/instrumentation-http, directly or through @opentelemetry/auto-instrumentations-node, is exposed when it receives inbound requests with credentials in the query string. Services that fetch presigned S3/GCS downloads, use Azure SAS URLs, or accept signature-authenticated webhooks are the common cases. Services without such inbound query credentials, or with traces not readable by broad audiences, are less exposed.
Not affected if no-query-credentials, versions-at-or-above-0.222.0
Who cares aws-s3, azure, gcs, node.js, observability, opentelemetry
npm ls @opentelemetry/instrumentation-http and check whether any resolved version is below 0.222.0, including transitive copies pulled in by @opentelemetry/auto-instrumentations-node.Upgrade to 0.222.0
@opentelemetry/instrumentation-http redacts sensitive URL query parameters on outgoing (client) spans but not on incoming (server) spans. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (sig), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend.
Configuring the redactedQueryParams option does not change this, as this applies only to outgoing (client) spans.
Information disclosure / credential leakage (CWE-200; CWE-532, insertion of sensitive information into telemetry data).
Who is impacted: any Node.js service instrumented with @opentelemetry/instrumentation-http — directly or transitively via @opentelemetry/auto-instrumentations-node — that receives inbound requests carrying credentials in the query string. Common cases: services fronting presigned S3/GCS downloads, Azure SAS-token URLs, and signature-authenticated webhooks.
Consequence: clients' still-valid credentials are written into server spans and stored by the tracing backend, readable by anyone with span-read access — observability vendor infrastructure, dashboard users, and internal audiences far broader than the credential's intended scope. Presigned-URL signatures typically remain valid for minutes to days after capture, so this is not merely historical exposure.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
@opentelemetry/instrumentation-http 0.222.0redactedQueryParamsServer is available for customization of server-span redaction.Severity: Moderate. Exploitation requires read access to the telemetry backend, and inbound URLs must actually carry signed credentials. However, the gap is a documented mitigation that silently fails to apply, which defeats the mitigation operators would reach for.
This vulnerability has been patched in @opentelemetry/instrumentation-http version 0.222.0.
Known sensitive query string values (as defined by Semantic Conventions) are redacted by default from span data for incoming spans.
The redactedQueryParamsServer configuration option was added for customization.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.