CVE-2026-128080: Sensitive Query Parameter Disclosure on Incoming Server Spans in OpenTelemetry JavaScript (@opentelemetry/instrumentation-http)

Vulnerability ID: CVE-2026-128080
CVSS Score: 5.8
Published: 2026-11-13

An information exposure vulnerability in the @opentelemetry/instrumentation-http package for OpenTelemetry JavaScript versions 0.204.0 prior to 0.222.0 causes incoming HTTP server spans to record raw, unredacted query string parameters under the url.query attribute. While outgoing client spans applied built-in and user-configured query parameter redaction, incoming server spans bypassed this sanitization completely, resulting in the transmission of sensitive credentials such as pre-signed cloud URLs and API tokens to external observability backends.

TL;DR

Versions 0.204.0 to < 0.222.0 of @opentelemetry/instrumentation-http fail to redact sensitive query string parameters on incoming HTTP server spans. Raw query parameters are written verbatim to the url.query attribute and exported to tracing backends, exposing credentials such as AWS/GCS pre-signed signatures and API keys to users with telemetry read access. Upgrade to version 0.222.0 or later to remediate.

Technical Details

• CVE / Advisory ID: CVE-2026-128080 / GHSA-3v2p-hm54-8qcq
• Affected Package: @opentelemetry/instrumentation-http (0.204.0 to < 0.222.0)
• Weakness Class: CWE-532 (Sensitive Info in Logs) / CWE-200 (Information Exposure)
• CVSS v3.1 Score: 5.8 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
• Attack Vector: Network (Unauthenticated HTTP requests with query parameters)
• Security Impact: Plaintext export of query string credentials (url.query) to tracing backends
• Exploit / KEV Status: No known public exploits; Not listed in CISA KEV (EPSS: 0%)
• Patched Version: 0.222.0 (experimental/v0.222.0)

Affected Systems

• @opentelemetry/instrumentation-http (npm package for Node.js / OpenTelemetry JavaScript)
• @opentelemetry/instrumentation-http: >= 0.204.0, < 0.222.0 (Fixed in: 0.222.0)

Code Analysis

Commit: e086dec

fix(instrumentation-http): redact sensitive query params on server spans (Fixes GHSA-3v2p-hm54-8qcq)

diff --git a/experimental/packages/opentelemetry-instrumentation-http/src/utils.ts b/experimental/packages/opentelemetry-instrumentation-http/src/utils.ts
index 786977867ae..2aceb0d84d1 100644
--- a/experimental/packages/opentelemetry-instrumentation-http/src/utils.ts
+++ b/experimental/packages/opentelemetry-instrumentation-http/src/utils.ts
@@ -55,6 +55,25 @@ import {
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 import forwardedParse = require('forwarded-parse');

+const defaultQueryStringsToRedact = Array.from(DEFAULT_QUERY_STRINGS_TO_REDACT);
+
+/**
+ * Redacts sensitive query parameters from a query string (without leading '?').
+ * Returns the input unchanged if it cannot be parsed.
+ */
+export const redactQueryString = (
+  searchParams: URLSearchParams,
+  paramsToRedact: string[]
+): string => {
+  const params = new URLSearchParams(searchParams);
+  for (const param of paramsToRedact) {
+    if (params.has(param)) {
+      params.set(param, STR_REDACTED);
+    }
+  }
+  return params.toString();
+};
+
 /**
  * Get an absolute url
  */
@@ -80,19 +99,14 @@ export const getAbsoluteUrl = (
   ) {
     host += `:${port}`;
   }
-  // Redact sensitive query parameters
   if (path.includes('?')) {
     try {
       const parsedUrl = new URL(path, 'http://localhost');
-      const sensitiveParamsToRedact: string[] = redactedQueryParams || [];
-
-      for (const sensitiveParam of sensitiveParamsToRedact) {
-        if (parsedUrl.searchParams.get(sensitiveParam)) {
-          parsedUrl.searchParams.set(sensitiveParam, STR_REDACTED);
-        }
-      }
-
-      path = `${parsedUrl.pathname}${parsedUrl.search}`;
+      const redacted = redactQueryString(
+        parsedUrl.searchParams,
+        redactedQueryParams
+      );
+      path = `${parsedUrl.pathname}?${redacted}`;
     } catch {
       // Ignore error, as the path was not a valid URL.
     }
@@ -700,10 +714,16 @@ export const getIncomingRequestAttributes = (
     component: 'http' | 'https';
     hookAttributes?: Attributes;
     enableSyntheticSourceDetection: boolean;
+    redactedQueryParams?: string[];
   },
   logger: DiagLogger
 ): Attributes => {
-  const { component, enableSyntheticSourceDetection, hookAttributes } = options;
+  const {
+    component,
+    enableSyntheticSourceDetection,
+    hookAttributes,
+    redactedQueryParams,
+  } = options;
   const { headers, method } = request;
   const { 'user-agent': userAgent } = headers;
   const parsedUrl = getInfoFromIncomingMessage(component, request, logger);
@@ -729,7 +749,11 @@ export const getIncomingRequestAttributes = (

   if (parsedUrl.search) {
     // Remove leading '?' from URL search (https://developer.mozilla.org/en-US/docs/Web/API/URL/search).
-    attributes[ATTR_URL_QUERY] = parsedUrl.search.slice(1);
+    const paramsToRedact = redactedQueryParams ?? defaultQueryStringsToRedact;
+    attributes[ATTR_URL_QUERY] = redactQueryString(
      new URLSearchParams(parsedUrl.search.slice(1)),
      paramsToRedact
    );
   }

Mitigation Strategies

• Upgrade @opentelemetry/instrumentation-http to version 0.222.0 or later to enable automatic default query parameter redaction on incoming server spans.
• Explicitly configure both redactedQueryParams and redactedQueryParamsServer when using custom parameter redaction lists, ensuring built-in defaults are also preserved in the array.
• Implement a custom OpenTelemetry SpanProcessor or OpenTelemetry Collector transform processor to scrub or drop the url.query attribute prior to trace storage if package upgrades are delayed.
• Avoid transmitting sensitive authentication credentials, session identifiers, or API keys in URL query parameters; use HTTP request headers (such as Authorization) or request bodies instead.
• Audit historical trace data in APM and observability backends for leaked credentials and rotate any non-expired tokens or keys.

Remediation Steps:

1. Update package.json to require @opentelemetry/instrumentation-http >= 0.222.0 and run npm install, yarn upgrade, or pnpm update.
2. Inspect all HttpInstrumentation initialization blocks in your codebase; if redactedQueryParams is set, duplicate the array into the redactedQueryParamsServer property and include the seven default parameter names.
3. Verify in staging or development trace output that incoming HTTP requests containing sensitive query strings record 'REDACTED' in the url.query attribute.
4. Purge or mask historical spans containing plaintext secrets in your observability backend and rotate affected credentials.

References

• GitHub Security Advisory: GHSA-3v2p-hm54-8qcq
• Official Fix Commit (e086dec7f9304107ef6d50b5877be88895c06aa7)
• OpenTelemetry JS Release experimental/v0.222.0
• CVE.org Record: CVE-2026-128080
• OSV Vulnerability Entry: GHSA-3v2p-hm54-8qcq
• NVD Vulnerability Detail: CVE-2026-128080
• CVEListV5 JSON Source for CVE-2026-128080
• Wiz Vulnerability Database: CVE-2026-128080

Read the full report for CVE-2026-128080 on our website for more details including interactive diagrams and full exploit analysis.