Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-201.
Summary
OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-dotnet | before 1.8.1 | 1.8.1 | Patch available | CNA |
| — | OpenTelemetry.Instrumentation.Http (NuGet) | before 1.8.1 | 1.8.1 | Patch available | GHSA-vh2m-22xx-q94f |
| — | OpenTelemetry.Instrumentation.AspNetCore (NuGet) | before 1.8.1 | 1.8.1 | Patch available | GHSA-vh2m-22xx-q94f |
- opentelemetry-dotnet Vendoropen-telemetry Affected before 1.8.1 Fixed in 1.8.1 Patch available CNA
- OpenTelemetry.Instrumentation.Http (NuGet) Vendor— Affected before 1.8.1 Fixed in 1.8.1 Patch available GHSA-vh2m-22xx-q94f
- OpenTelemetry.Instrumentation.AspNetCore (NuGet) Vendor— Affected before 1.8.1 Fixed in 1.8.1 Patch available GHSA-vh2m-22xx-q94f
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* | — | — | open-telemetry |
- cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* Versions — — ·open-telemetry
Remediation
- Fix · CNA opentelemetry-dotnet (open-telemetry) Fixed in 1.8.1
- Fix · GHSA-vh2m-22xx-q94f OpenTelemetry.Instrumentation.Http (NuGet) Fixed in 1.8.1 Advisory →
- Fix · GHSA-vh2m-22xx-q94f OpenTelemetry.Instrumentation.AspNetCore (NuGet) Fixed in 1.8.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-32028
- 2026-10-03 Alias added: GHSA-vh2m-22xx-q94f
References
Other 4
- https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f
- https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42
- https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md
- https://github.com/open-telemetry/opentelemetry-dotnet
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2024-32028 · CVE Program
- CVE-2024-32028 · NVD
- FIRST EPSS
- GHSA-vh2m-22xx-q94f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences