Medium, CVSS 5.8npmAmendedPublished
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
CVE-2026-128080 · GHSA-3v2p-hm54-8qcq
- Affected
- npm @opentelemetry/instrumentation-http >= 0.204.0, < 0.222.0
- Fixed in
- 0.222.0· Vendor fix available
- Issue
- `@opentelemetry/instrumentation-http` redacts sensitive URL query parameters on outgoing (client) spans but not on incoming (server) spans. The server-span path writes the raw query string verbatim into the `url.query` attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (`sig`), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend. Configuring the `redactedQueryParams` option does not change this, as this applies only to outgoing (client) spans. Impact Information disclosure / credential leakage (CWE-200; CWE-532, insertion of sensitive information into telemetry data). Who is impacted: any Node.js service instrumented with `@opentelemetry/instrumentation-http` — directly or transitively via `@opentelemetry/auto-instrumentations-node` — that receives inbound requests carrying credentials in the query string. Common cases: services fronting presigned S3/GCS…
Recommended action: Upgrade to 0.222.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.