CVE-2026-128080: OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
Summary
@opentelemetry/instrumentation-http redacts sensitive URL query parameters on outgoing (client) spans but not on incoming (server) spans. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (sig), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend.
Configuring the redactedQueryParams option does not change this, as this applies only to outgoing (client) spans.
Impact
Information disclosure / credential leakage (CWE-200; CWE-532, insertion of sensitive information into telemetry data).
Who is impacted: any Node.js service instrumented with @opentelemetry/instrumentation-http — directly or transitively via @opentelemetry/auto-instrumentations-node — that receives inbound requests carrying credentials in the query string. Common cases: services fronting presigned S3/GCS downloads, Azure SAS-token URLs, and signature-authenticated webhooks.
Consequence: clients' still-valid credentials are written into server spans and stored by the tracing backend, readable by anyone with span-read access — observability vendor infrastructure, dashboard users, and internal audiences far broader than the credential's intended scope. Presigned-URL signatures typically remain valid for minutes to days after capture, so this is not merely historical exposure.
Severity: Moderate. Exploitation requires read access to the telemetry backend, and inbound URLs must actually carry signed credentials. However, the gap is a documented mitigation that silently fails to apply, which defeats the mitigation operators would reach for.
Patches
This vulnerability has been patched in @opentelemetry/instrumentation-http version 0.222.0. Known sensitive query string values (as defined by Semantic Conventions) are redacted by default from span data for incoming spans. The redactedQueryParamsServer configuration option was added for customization.
Other sources
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@opentelemetry/instrumentation-httpto a version that resolves this vulnerability.Fixed in 0.222.0 - Upgrade
Upgrade
@opentelemetry/instrumentation-httpto a version that resolves this vulnerability.Fixed in 0.222.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Any Node.js service using @opentelemetry/instrumentation-http, either directly or through @opentelemetry/auto-instrumentations-node, is exposed if it receives inbound requests with credentials in URL query parameters. Common examples include presigned S3 or GCS URLs, Azure SAS-token URLs, and signature-authenticated webhooks.
Does configuring redactedQueryParams protect inbound requests?
No. The redactedQueryParams option applies only to outgoing client spans and does not redact query strings recorded on incoming server spans.
What information could be exposed and where does it go?
The raw inbound query string is recorded in the url.query server-span attribute and exported to the configured tracing backend. This can expose still-valid credentials to users who can read stored traces.
How can I determine whether credentials may already have been exposed?
Review exported server spans in the tracing backend for the url.query attribute, especially for services receiving signed URLs, SAS tokens, or signature-authenticated webhook requests. Presence of raw credential-bearing query strings indicates that those values were exported.