CVE-2026-128080

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128080
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128080.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128080
Aliases
Published
2026-11-13T18:25:38Z
Modified
2026-11-14T02:47:33Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
Details

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-532"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128080.json"
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-js

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-js
Events
Introduced
98f9d720af84bc38074dfd4ab7760ae83a3e9826
Fixed
0b72a81636fa476e8f1f1afd2ae0c90a1362194c
Fixed
e086dec7f9304107ef6d50b5877be88895c06aa7
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.204.0"
                },
                {
                    "fixed": "0.222.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "e086dec7f9304107ef6d50b5877be88895c06aa7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

api/v1.*
api/v1.9.1
experimental/v0.*
experimental/v0.204.0
experimental/v0.205.0
experimental/v0.206.0
experimental/v0.207.0
experimental/v0.208.0
experimental/v0.209.0
experimental/v0.210.0
experimental/v0.211.0
experimental/v0.212.0
experimental/v0.213.0
experimental/v0.214.0
experimental/v0.215.0
experimental/v0.216.0
experimental/v0.217.0
experimental/v0.218.0
experimental/v0.219.0
experimental/v0.220.0
experimental/v0.221.0
semconv/v1.*
semconv/v1.38.0
semconv/v1.39.0
semconv/v1.40.0
semconv/v1.41.1
semconv/v1.42.0
semconv/v1.43.0
v2.*
v2.1.0
v2.10.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128080.json"