CVE-2026-128080

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.

• CWE-200
• CWE-532

• https://github.com/open-telemetry/opentelemetry-js/commit/e086dec7f9304107ef6d50b5877be88895c06aa7
• https://github.com/open-telemetry/opentelemetry-js/releases/tag/experimental/v0.222.0
• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-3v2p-hm54-8qcq

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-128075Nuxt is an open-source web development framework for Vue.js.…5.3
• CVE-2026-128076Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2026-128077Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-128078GLPI is a free asset and IT management software package. Fro…5.3
• CVE-2026-128079envd provides reproducible development environments for huma…6.8
• CVE-2026-12808A vulnerability was determined in Edimax BR-6478AC V2 1.23. …6.3
• CVE-2026-128081AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-128082AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-128083Laravel is a web application framework. Prior to 12.71.0 and…2.3
• CVE-2026-128084sqlite3 provides Ruby bindings for the SQLite3 embedded data…4.8
• CVE-2026-128085OpenTelemetry-Go is the Go implementation of OpenTelemetry. …5.3
• CVE-2026-128086OpenTelemetry-Go is the Go implementation of OpenTelemetry. …5.3