{"affected":[{"product":"opentelemetry-js","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":">= 0.204.0, < 0.222.0"}]}],"cveId":"CVE-2026-128080","cwes":["CWE-200","CWE-532"],"description":"OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.8,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794594338014,"publishedAt":1794594338014,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-3v2p-hm54-8qcq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-js/commit/e086dec7f9304107ef6d50b5877be88895c06aa7"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-js/releases/tag/experimental/v0.222.0"}],"remediation":[],"revision":"d8a1b0a07304b8e83708c7ba4d194747b10e450d2543f75000399236b2367dc8","sources":[{"modifiedAt":1794594338014,"name":"CNA: GitHub_M","retrievedAt":1794597917080,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128080"}],"ssvc":null,"status":"published","title":"OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http","updatedAt":1794597917080}