OpenTelemetry JavaScript Vulnerability in HTTP Instrumentation by OpenTelemetry
CVE-2026-128080

5.8MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-js
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128080?

The OpenTelemetry JavaScript client, specifically the @opentelemetry/instrumentation-http module, incorrectly handles raw query strings from incoming HTTP requests in versions 0.204.0 through 0.222.0. This flaw allows sensitive information, such as signed URLs or credentials embedded in query parameters, to be exposed via the url.query attribute in server spans. These secrets can be accessed by anyone with span-read capabilities on the tracing backends, thus posing a significant risk to data security. The issue has been resolved in version 0.222.0 where proper protection mechanisms were enforced for incoming spans.

Affected Version(s)

opentelemetry-js >= 0.204.0, < 0.222.0

References

https://github.com/open-telemetry/opentelemetry-js/securi...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-js/commit...
x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-js/releas...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.