CVE-2026-128080: 
JavaScript vulnerability analysis and mitigation

CVE-2026-128080 is a credential/token disclosure vulnerability in the @opentelemetry/instrumentation-http package (OpenTelemetry JavaScript client) where raw query strings from incoming HTTP requests are written verbatim to the url.query server-span attribute without applying the redactedQueryParams protection that is applied to outgoing spans. This affects versions >= 0.204.0 and < 0.222.0 of the npm package. The vulnerability was published on November 13, 2026, with a patch available in version 0.222.0. It carries a CVSS v3.1 base score of 5.8 (Moderate) (Github Advisory, Feedly).

The root cause is an asymmetric implementation of query parameter redaction: the getAbsoluteUrl() function applied redaction to outgoing (client) spans, but the getIncomingRequestAttributes() function wrote the raw parsedUrl.search string directly to the ATTR_URL_QUERY attribute on incoming (server) spans without any sanitization (CWE-200, CWE-532). Critically, configuring the redactedQueryParams option had no effect on server spans, making the documented mitigation silently inert. The fix in commit e086dec extracted a shared redactQueryString() helper and applied it in getIncomingRequestAttributes(), defaulting to a built-in list of sensitive parameters (sig, Signature, AWSAccessKeyId, X-Goog-Signature, X-Amz-Signature, X-Amz-Credential, X-Amz-Security-Token), and introduced a new redactedQueryParamsServer configuration option for independent server-side control (Github Advisory, Patch Commit).

Any Node.js service instrumented with @opentelemetry/instrumentation-http — directly or transitively via @opentelemetry/auto-instrumentations-node — that receives inbound requests carrying credentials in query parameters is affected. Credentials such as AWS presigned-URL signatures, Azure SAS tokens (sig), GCS signed-URL signatures, and signature-authenticated webhook tokens are exported in plaintext to the configured tracing backend, where they are readable by anyone with span-read access, including observability vendor infrastructure, dashboard users, and internal audiences far beyond the credential's intended scope. Since presigned-URL signatures typically remain valid for minutes to days after capture, the exposure represents active, exploitable credential leakage rather than merely historical data (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to already have read access to the tracing/telemetry backend, and the target service must actually receive inbound HTTP requests carrying credentials in query parameters — conditions that limit the attack surface but are common in cloud-native environments using presigned URLs or SAS tokens (Github Advisory, Feedly).

1. Identify a target service: Locate a Node.js service instrumented with @opentelemetry/instrumentation-http versions 0.204.0–0.221.x that receives inbound HTTP requests with credentials in query parameters (e.g., a service fronting presigned S3/GCS downloads or Azure SAS-token URLs).
2. Send a crafted request: Issue an HTTP request to the target service containing sensitive credentials in the query string, such as GET /resource?sig=SECRET&X-Amz-Signature=AWSSECRET&foo=bar.
3. Trigger span recording: The instrumentation automatically records the incoming request as a server span, writing the raw query string — including the unredacted credential values — to the url.query span attribute.
4. Access the tracing backend: With read access to the configured tracing backend (e.g., Jaeger, Zipkin, an observability SaaS platform), query or browse spans for the target service to retrieve the plaintext credential values from the url.query attribute.
5. Exploit captured credentials: Use the still-valid presigned URLs or tokens to access the underlying cloud resources (e.g., S3 objects, Azure Blob Storage) within their validity window (Github Advisory).

• Logs/Telemetry: Server spans in the tracing backend with url.query attributes containing unredacted values for parameters such as sig, Signature, AWSAccessKeyId, X-Goog-Signature, X-Amz-Signature, X-Amz-Credential, or X-Amz-Security-Token — these should appear as REDACTED in patched versions.
• Tracing Backend: Unusual or unauthorized queries to span data in observability platforms (Jaeger, Zipkin, Datadog, etc.) targeting services that handle presigned URLs or SAS tokens.
• Network: Unexpected use of presigned URLs or SAS tokens from IP addresses or user agents inconsistent with legitimate clients, potentially indicating credential replay after extraction from span data.

Upgrade @opentelemetry/instrumentation-http to version 0.222.0 or later, which applies redaction to both incoming (server) and outgoing (client) spans by default and introduces the new redactedQueryParamsServer configuration option for independent per-side control (Github Advisory, Release Notes). For services that cannot immediately upgrade, the recommended workarounds are: (1) avoid passing sensitive information (credentials, signed URLs, authentication tokens) in HTTP query parameters; and (2) restrict access to tracing backends and span data to minimize the blast radius of any credential exposure. Note that setting redactedQueryParams in affected versions does not protect server spans — this option only applies to outgoing spans in versions prior to 0.222.0.

The vulnerability was reported by researcher klobucar and the advisory was published by trentm on the OpenTelemetry JS repository. The GitHub advisory notes that the gap is particularly concerning because it represents a documented mitigation (redactedQueryParams) that silently fails to apply to server spans, which could give operators a false sense of security (Github Advisory). No broader media coverage or notable social media reactions have been identified at this time.