{"id":"CVE-2026-128080","kind":"vulnerability","aliases":["CVE-2026-128080","GHSA-3v2p-hm54-8qcq"],"related":[],"title":"OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http","description":"### Summary\n\n`@opentelemetry/instrumentation-http` redacts sensitive URL query parameters on **outgoing (client) spans** but not on **incoming (server) spans**. The server-span path writes the raw query string verbatim into the `url.query` attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (`sig`), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend.\n\nConfiguring the `redactedQueryParams` option **does not change this**, as this applies only to outgoing (client) spans.\n\n### Impact\n\n**Information disclosure / credential leakage** (CWE-200; CWE-532, insertion of sensitive information into telemetry data).\n\n**Who is impacted:** any Node.js service instrumented with `@opentelemetry/instrumentation-http` — directly or transitively via `@opentelemetry/auto-instrumentations-node` — that receives inbound requests carrying credentials in the query string. Common cases: services fronting presigned S3/GCS downloads, Azure SAS-token URLs, and signature-authenticated webhooks.\n\n**Consequence:** clients' still-valid credentials are written into server spans and stored by the tracing backend, readable by anyone with span-read access — observability vendor infrastructure, dashboard users, and internal audiences far broader than the credential's intended scope. Presigned-URL signatures typically remain valid for minutes to days after capture, so this is not merely historical exposure.\n\n**Severity:** Moderate. Exploitation requires read access to the telemetry backend, and inbound URLs must actually carry signed credentials. However, the gap is a documented mitigation that silently fails to apply, which defeats the mitigation operators would reach for.\n\n### Patches\n\nThis vulnerability has been patched in `@opentelemetry/instrumentation-http` version `0.222.0`.\nKnown sensitive query string values (as defined by Semantic Conventions) are redacted by default from span data for incoming spans.\nThe `redactedQueryParamsServer` configuration option was added for customization.","summary":"The @opentelemetry/instrumentation-http package redacts sensitive query parameters on outgoing spans but writes raw query strings from incoming server requests into traces. An attacker with read access to the tracing backend can recover still-valid credentials such as presigned S3/GCS signatures or Azure SAS tokens.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@opentelemetry/instrumentation-http","fixed":["0.222.0"],"affected":">= 0.204.0, < 0.222.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["aws-s3","azure","cwe-200","cwe-532","gcs","node.js","observability","opentelemetry","package"],"not_affected_if":["no-query-credentials","versions-at-or-above-0.222.0"],"how_to_check":"- Run `npm ls @opentelemetry/instrumentation-http` and check whether any resolved version is below `0.222.0`, including transitive copies pulled in by `@opentelemetry/auto-instrumentations-node`.\n- Check whether inbound requests carry credentials in the query string, such as presigned URLs or SAS tokens, and whether those spans are exported to a tracing backend.","fix":"- `@opentelemetry/instrumentation-http` `0.222.0`\n- Setting `redactedQueryParamsServer` is available for customization of server-span redaction.","status":"open","published_at":"2026-11-13T19:19:30+00:00","first_seen_at":"2026-11-13T19:34:09+00:00","triaged_at":"2026-11-13T19:35:10+00:00","updated_at":"2026-11-13T19:52:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T19:35:10Z","model":"claude-haiku-5-5","output":{"fix":"- `@opentelemetry/instrumentation-http` `0.222.0`\n- Setting `redactedQueryParamsServer` is available for customization of server-span redaction.","reach":"internet","title":"OpenTelemetry HTTP instrumentation leaks signed URL credentials into server traces","impact":"medium","summary":"The @opentelemetry/instrumentation-http package redacts sensitive query parameters on outgoing spans but writes raw query strings from incoming server requests into traces. An attacker with read access to the tracing backend can recover still-valid credentials such as presigned S3/GCS signatures or Azure SAS tokens.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","opentelemetry","observability","aws-s3","azure","gcs"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"signed credentials readable by anyone with trace access","analyst_note":"","how_to_check":"- Run `npm ls @opentelemetry/instrumentation-http` and check whether any resolved version is below `0.222.0`, including transitive copies pulled in by `@opentelemetry/auto-instrumentations-node`.\n- Check whether inbound requests carry credentials in the query string, such as presigned URLs or SAS tokens, and whether those spans are exported to a tracing backend.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-query-credentials","versions-at-or-above-0.222.0"],"who_is_affected":"Any Node.js service instrumented with @opentelemetry/instrumentation-http, directly or through @opentelemetry/auto-instrumentations-node, is exposed when it receives inbound requests with credentials in the query string. Services that fetch presigned S3/GCS downloads, use Azure SAS URLs, or accept signature-authenticated webhooks are the common cases. Services without such inbound query credentials, or with traces not readable by broad audiences, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000892,"input_tokens":5324,"output_tokens":720,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128080':23A,31A '-200':38B,175C '-2026':22A,30A '-532':40B,177C '0.222.0':334C '3v2p':26A '8qcq':28A 'access':71B,250C,292C 'actor':18A 'actual':301C 'add':360C 'anyon':245C 'appli':163C,316C 'attack':68B 'attribut':122C 'audienc':258C 'authent':224C 'aw':34B,130C 'aws-s3':33B 'azur':36B,88B,135C,216C 'backend':75B,152C,242C,296C 'broader':260C 'captur':279C 'carri':203C,302C 'case':210C 'chang':159C 'client':100C,167C,227C 'common':209C 'configur':150C,153C,357C 'consequ':226C 'convent':344C 'credenti':81B,124C,172C,204C,231C,263C,304C 'custom':362C 'cve':21A,29A 'cwe':37B,39B,174C,176C 'dashboard':254C 'data':184C,351C 'day':277C 'default':348C 'defeat':318C 'defin':341C 'direct':194C 'disclosur':171C 'document':310C 'download':215C 'embed':125C 'exploit':289C 'export':145C 'exposur':11A,286C 'fail':314C 'far':259C 'file':9A 'front':212C 'gap':307C 'gcs':41B,139C 'ghsa':25A 'ghsa-3v2p-hm54-8qcq':24A 'histor':285C 'hm54':27A 'howev':305C 'impact':169C,187C 'inbound':127C,201C,298C 'incom':62B,105C,353C 'inform':6A,14A,170C,181C 'infrastructur':253C 'insert':3A,178C 'instrument':191C 'intend':265C 'intern':257C 'javascript':2A 'known':335C 'leakag':173C 'log':8A 'mere':284C 'minut':275C 'mitig':311C,320C 'moder':288C 'must':300C 'node.js':42B,189C 'observ':43B,251C 'opentelemetri':1A,44B 'opentelemetry/auto-instrumentations-node':198C 'opentelemetry/instrumentation-http':20A,32A,47B,92C,193C,332C 'oper':321C 'option':156C,358C 'outgo':54B,99C,166C 'packag':45B,48B 'paramet':52B,97C 'patch':325C,330C 'path':112C 'plaintext':147C 'presign':84B,132C,213C,268C 'presigned-url':131C,267C 'queri':51B,59B,96C,116C,207C,337C 'raw':58B,115C 'reach':323C 'read':70B,249C,291C 'readabl':243C 'receiv':200C 'recov':77B 'redact':49B,93C,346C 'redactedqueryparam':155C 'redactedqueryparamsserv':356C 'remain':272C 'request':64B,128C,202C 'requir':290C 's3':35B 's3/gcs':85B,214C 'sas':89B,136C,218C 'sas-token':217C 'scope':266C 'semant':343C 'sensit':5A,13A,50B,94C,180C,336C 'server':63B,106C,110C,235C 'server-span':109C 'servic':190C,211C 'sever':287C 'sig':138C 'sign':141C,303C 'signatur':86B,134C,143C,223C,270C 'signature-authent':222C 'signed-url':140C 'silent':313C 'span':55B,101C,107C,111C,168C,236C,248C,350C,354C 'span-read':247C 'still':79B,229C 'still-valid':78B,228C 'store':238C 'string':60B,117C,208C,338C 'summari':91C 'telemetri':183C,295C 'token':90B,137C,219C 'trace':66B,74B,151C,241C 'transit':196C 'typic':271C 'unauthor':17A 'url':95C,129C,133C,142C,220C,269C,299C 'url.query':121C 'user':255C 'valid':80B,230C,273C 'valu':339C 'vendor':252C 'verbatim':118C 'version':333C 'via':197C 'vulner':327C 'webhook':225C 'would':322C 'write':57B,113C 'written':233C","nicknames":[],"mitigations":[],"who_affected":"Any Node.js service instrumented with @opentelemetry/instrumentation-http, directly or through @opentelemetry/auto-instrumentations-node, is exposed when it receives inbound requests with credentials in the query string. Services that fetch presigned S3/GCS downloads, use Azure SAS URLs, or accept signature-authenticated webhooks are the common cases. Services without such inbound query credentials, or with traces not readable by broad audiences, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["instrumentationhttp"],"ptokens":["http","instrumentation","opentelemetry"],"labels":["awss3","azure","cwe200","cwe532","gcs","medium","nodejs","npm","observability","opentelemetry","package"],"campaign_type":null,"search_a":"'-128080':23A,31A '-2026':22A,30A '3v2p':26A '8qcq':28A 'actor':18A 'cve':21A,29A 'exposur':11A 'file':9A 'ghsa':25A 'ghsa-3v2p-hm54-8qcq':24A 'hm54':27A 'inform':6A,14A 'insert':3A 'javascript':2A 'log':8A 'opentelemetri':1A 'opentelemetry/instrumentation-http':20A,32A 'sensit':5A,13A 'unauthor':17A","search_b":"'-200':38B '-532':40B 'access':71B 'attack':68B 'aw':34B 'aws-s3':33B 'azur':36B,88B 'backend':75B 'credenti':81B 'cwe':37B,39B 'gcs':41B 'incom':62B 'node.js':42B 'observ':43B 'opentelemetri':44B 'opentelemetry/instrumentation-http':47B 'outgo':54B 'packag':45B,48B 'paramet':52B 'presign':84B 'queri':51B,59B 'raw':58B 'read':70B 'recov':77B 'redact':49B 'request':64B 's3':35B 's3/gcs':85B 'sas':89B 'sensit':50B 'server':63B 'signatur':86B 'span':55B 'still':79B 'still-valid':78B 'string':60B 'token':90B 'trace':66B,74B 'valid':80B 'write':57B","search_c":"'-200':175C '-532':177C '0.222.0':334C 'access':250C,292C 'actual':301C 'add':360C 'anyon':245C 'appli':163C,316C 'attribut':122C 'audienc':258C 'authent':224C 'aw':130C 'azur':135C,216C 'backend':152C,242C,296C 'broader':260C 'captur':279C 'carri':203C,302C 'case':210C 'chang':159C 'client':100C,167C,227C 'common':209C 'configur':150C,153C,357C 'consequ':226C 'convent':344C 'credenti':124C,172C,204C,231C,263C,304C 'custom':362C 'cwe':174C,176C 'dashboard':254C 'data':184C,351C 'day':277C 'default':348C 'defeat':318C 'defin':341C 'direct':194C 'disclosur':171C 'document':310C 'download':215C 'embed':125C 'exploit':289C 'export':145C 'exposur':286C 'fail':314C 'far':259C 'front':212C 'gap':307C 'gcs':139C 'histor':285C 'howev':305C 'impact':169C,187C 'inbound':127C,201C,298C 'incom':105C,353C 'inform':170C,181C 'infrastructur':253C 'insert':178C 'instrument':191C 'intend':265C 'intern':257C 'known':335C 'leakag':173C 'mere':284C 'minut':275C 'mitig':311C,320C 'moder':288C 'must':300C 'node.js':189C 'observ':251C 'opentelemetry/auto-instrumentations-node':198C 'opentelemetry/instrumentation-http':92C,193C,332C 'oper':321C 'option':156C,358C 'outgo':99C,166C 'paramet':97C 'patch':325C,330C 'path':112C 'plaintext':147C 'presign':132C,213C,268C 'presigned-url':131C,267C 'queri':96C,116C,207C,337C 'raw':115C 'reach':323C 'read':249C,291C 'readabl':243C 'receiv':200C 'redact':93C,346C 'redactedqueryparam':155C 'redactedqueryparamsserv':356C 'remain':272C 'request':128C,202C 'requir':290C 's3/gcs':214C 'sas':136C,218C 'sas-token':217C 'scope':266C 'semant':343C 'sensit':94C,180C,336C 'server':106C,110C,235C 'server-span':109C 'servic':190C,211C 'sever':287C 'sig':138C 'sign':141C,303C 'signatur':134C,143C,223C,270C 'signature-authent':222C 'signed-url':140C 'silent':313C 'span':101C,107C,111C,168C,236C,248C,350C,354C 'span-read':247C 'still':229C 'still-valid':228C 'store':238C 'string':117C,208C,338C 'summari':91C 'telemetri':183C,295C 'token':137C,219C 'trace':151C,241C 'transit':196C 'typic':271C 'url':95C,129C,133C,142C,220C,269C,299C 'url.query':121C 'user':255C 'valid':230C,273C 'valu':339C 'vendor':252C 'verbatim':118C 'version':333C 'via':197C 'vulner':327C 'webhook':225C 'would':322C 'write':113C 'written':233C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:37:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-3v2p-hm54-8qcq","url":"https://github.com/advisories/GHSA-3v2p-hm54-8qcq","severity":"medium","published_at":"2026-11-13T19:29:20+00:00","modified_at":"2026-11-13T19:29:21+00:00","first_seen_at":"2026-11-13T19:34:09+00:00","fetched_at":"2026-11-13T19:34:36+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-128080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128080","severity":null,"published_at":"2026-11-13T19:19:30+00:00","modified_at":"2026-11-13T19:19:30+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":148945,"url":"https://api.github.com/repos/open-telemetry/opentelemetry-js/security-advisories/GHSA-3v2p-hm54-8qcq","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":148946,"url":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-3v2p-hm54-8qcq","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-09T17:37:33+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":148947,"url":"https://github.com/open-telemetry/opentelemetry-js/commit/e086dec7f9304107ef6d50b5877be88895c06aa7","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148948,"url":"https://github.com/open-telemetry/opentelemetry-js/releases/tag/experimental/v0.222.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}