Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-128080— OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http

Quick assessment

Affected
open-telemetry opentelemetry-js
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenTelemetry JavaScript 是 OpenTelemetry 的 JavaScript 客户端。在版本 0.204.0 至 0.222.0 之间， 包会将来自传入 HTTP 请求的原始查询字符串直接写入服务器端 span（span）的 属性中，而未应用用于出站 span 的 脱敏保护机制。因此，如果服务通过查询参数接收签名 URL 或其他凭据信息，这些仍然有效的敏感数据可能会被导出到追踪后端系统中，从而被具有 span 读取权限的可观测性基础设施和用户所访问。在受影响的版本中， 选项未能对传入的

CVSS 5.8 · Medium EPSS 0.36% · P31

Affected Version Matrix 1

VendorProduct Version RangeStatus
open-telemetry opentelemetry-js >= 0.204.0, < 0.222.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-128080

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
Source: CVE Program / CVE List V5
Vulnerability Description
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
open-telemetry opentelemetry-js >= 0.204.0, < 0.222.0 -

II. Public POCs for CVE-2026-128080

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-128080

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-128080 (1)

Vendor Pages for CVE-2026-128080 (1)

Same Patch Batch · open-telemetry · 2026-11-13 · 3 CVEs total

CVE-2026-128086 5.3 MEDIUM OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocat
CVE-2026-128085 5.3 MEDIUM opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed

IV. Related Vulnerabilities

Same product: opentelemetry-js
Same vendor: open-telemetry
Same weakness: CWE-200