---
id: "CVE-2026-128080"
page: "https://infrastack.ai/live/CVE-2026-128080"
kind: "vulnerability"
aliases: ["CVE-2026-128080", "GHSA-3v2p-hm54-8qcq"]
title: "OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@opentelemetry/instrumentation-http", "fixed": ["0.222.0"], "affected": ">= 0.204.0, < 0.222.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["aws-s3", "azure", "cwe-200", "cwe-532", "gcs", "node.js", "observability", "opentelemetry", "package"]
not_affected_if: ["no-query-credentials", "versions-at-or-above-0.222.0"]
published_at: "2026-11-13T19:19:30+00:00"
first_seen_at: "2026-11-13T19:34:09+00:00"
updated_at: "2026-11-13T19:52:09+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-3v2p-hm54-8qcq", "first_seen_at": "2026-11-13T19:34:09+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128080", "first_seen_at": "2026-11-13T19:52:09+00:00"}]
exploit_sources: []
---

# OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http

Link for people: https://infrastack.ai/live/CVE-2026-128080 (this .md is for agents)

The @opentelemetry/instrumentation-http package redacts sensitive query parameters on outgoing spans but writes raw query strings from incoming server requests into traces. An attacker with read access to the tracing backend can recover still-valid credentials such as presigned S3/GCS signatures or Azure SAS tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@opentelemetry/instrumentation-http affected >= 0.204.0, < 0.222.0 fixed 0.222.0

## How to check

- Run `npm ls @opentelemetry/instrumentation-http` and check whether any resolved version is below `0.222.0`, including transitive copies pulled in by `@opentelemetry/auto-instrumentations-node`.
- Check whether inbound requests carry credentials in the query string, such as presigned URLs or SAS tokens, and whether those spans are exported to a tracing backend.

## Fix

- `@opentelemetry/instrumentation-http` `0.222.0`
- Setting `redactedQueryParamsServer` is available for customization of server-span redaction.

## Timeline

- 2026-11-13T19:34:09+00:00 ghsa https://github.com/advisories/GHSA-3v2p-hm54-8qcq
- 2026-11-13T19:52:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128080

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/open-telemetry/opentelemetry-js/security-advisories/GHSA-3v2p-hm54-8qcq
- [advisory] Maintainer's advisory: github.com https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-3v2p-hm54-8qcq
- [fix] Patch: github.com https://github.com/open-telemetry/opentelemetry-js/commit/e086dec7f9304107ef6d50b5877be88895c06aa7
- [fix] Release: github.com https://github.com/open-telemetry/opentelemetry-js/releases/tag/experimental/v0.222.0

## From the sources

### Summary

`@opentelemetry/instrumentation-http` redacts sensitive URL query parameters on **outgoing (client) spans** but not on **incoming (server) spans**. The server-span path writes the raw query string verbatim into the `url.query` attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (`sig`), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend.

Configuring the `redactedQueryParams` option **does not change this**, as this applies only to outgoing (client) spans.

### Impact

**Information disclosure / credential leakage** (CWE-200; CWE-532, insertion of sensitive information into telemetry data).

**Who is impacted:** any Node.js service instrumented with `@opentelemetry/instrumentation-http` — directly or transitively via `@opentelemetry/auto-instrumentations-node` — that receives inbound requests carrying credentials in the query string. Common cases: services fronting presigned S3/GCS downloads, Azure SAS-token URLs, and signature-authenticated webhooks.

**Consequence:** clients' still-valid credentials are written into server spans and stored by the tracing backend, readable by anyone with span-read access — observability vendor infrastructure, dashboard users, and internal audiences far broader than the credential's intended scope. Presigned-URL signatures typically remain valid for minutes to days after capture, so this is not merely historical exposure.

**Severity:** Moderate. Exploitation requires read access to the telemetry backend, and inbound URLs must actually carry signed credentials. However, the gap is a documented mitigation that silently fails to apply, which defeats the mitigation operators would reach for.

### Patches

This vulnerability has been patched in `@opentelemetry/instrumentation-http` version `0.222.0`.
Known sensitive query string values (as defined by Semantic Conventions) are redacted by default from span data for incoming spans.
The `redactedQueryParamsServer` configuration option was added for customization.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_