CVE-2026-128080

### Summary `@opentelemetry/instrumentation-http` redacts sensitive URL query parameters on **outgoing (client) spans** but not on **incoming (server) spans**. The server-span path writes the raw query string verbatim into the `url.query` attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (`sig`), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend. Configuring the `redactedQueryParams` option **does not change this**, as this applies only to outgoing (client) spans. ### Impact **Information disclosure / credential leakage** (CWE-200; CWE-532, insertion of sensitive information into telemetry data). **Who is impacted:** any Node.js service instrumented with `@opentelemetry/instrumentation-http` — directly or transitively via `@opentelemetry/auto-instrumentations-node` — that receives inbound requests carrying credentials in the query string. Common cases: services fronting presigned S3/GCS downloads, Azure SAS-token URLs, and signature-authenticated webhooks. **Consequence:** clients' still-valid credentials are written into server spans and stored by the tracing backend, readable by anyone with span-read access — observability vendor infrastructure, dashboard users, and internal audiences far broader than the credential's intended scope. Presigned-URL signatures typically remain valid for minutes to days after capture, so this is not merely historical exposure. **Severity:** Moderate. Exploitation requires read access to the telemetry backend, and inbound URLs must actually carry signed credentials. However, the gap is a documented mitigation that silently fails to apply, which defeats the mitigation operators would reach for. ### Patches This vulnerability has been patched in `@opentelemetry/instrumentation-http` version `0.222.0`. Known sensitive query string values (as defined by Semantic Conventions) are redacted by default from span data for incoming spans. Th