CVE-2026-93426

Overview

SigNoz versions 0.87.0 through 0.141.9 allow authenticated users to inject arbitrary ClickHouse SQL via the v5 query_range API by failing to escape telemetry field-key names. Attackers with Viewer role or higher can read system tables and exfiltrate data. The flaw is a classic SQL injection that compromises data confidentiality.

Description

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.

Impact

Confidentiality is breached as attackers can read ClickHouse system tables and export sensitive data. Integrity may also be affected if malicious queries modify data. Availability is not directly impacted. The primary victims are SigNoz administrators and users with Viewer or higher roles who can authenticate to the API.

Remediation

Upgrade to SigNoz 0.142.0 or later where the telemetry field-key names are properly escaped. If an upgrade is not immediately possible, restrict the Viewer role or higher from accessing the v5 query_range endpoint, or implement a firewall rule to block external access to that API. Additionally, enable logging of query_range calls and monitor for anomalous backtick or quote usage.

Risk context

The vulnerability is rated high severity with a CVSS v3 score of 8.5. No EPSS data is available, but the high score indicates a significant risk. Prompt patching or mitigation is recommended.

Affected products

• SigNoz 0.87.0-0.141.9