CVE-2026-93292

Overview

SigNoz versions 0.88.0 through 0.142.0 allow authenticated users to inject arbitrary SQL into trace‑funnel analytics endpoints. The vulnerability arises from unsanitized service_name and span_name fields that are directly interpolated into ClickHouse queries, enabling attackers to read or modify data via HTTP responses.

Description

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

Impact

Authenticated attackers can compromise confidentiality by reading sensitive data, alter integrity by modifying database contents, and potentially disrupt availability if malicious queries overload the ClickHouse engine. The attack surface is limited to users with access to the trace‑funnel analytics API.

Remediation

1. Upgrade to SigNoz 0.142.1 or later where the input fields are properly parameterized. 2. If upgrading is not immediately possible, restrict API access to trusted users and apply network segmentation or firewall rules to limit exposure. 3. As a temporary measure, sanitize or whitelist service_name and span_name inputs before query construction.

Risk context

The CVSS v3 score of 8.5 and high severity rating indicate a significant threat that could lead to data leakage or tampering. Prompt patching or mitigation is recommended to prevent potential exploitation.

Affected products

• SigNoz