← Back to CVE List
CVE-2026-92729NVD
Vulnerability Summary
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
CVSS v4.0 Base Metrics — Score 8.8 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)None
Availability (Vulnerable System)Low
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 8.2 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityLow
Affected & Patched Versions
- SigNoz signoz >= 0.88.0 and < 0.141.1
- SigNoz signoz 0.141.1
External References
- https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
- https://github.com/SigNoz/signoz/pull/12817
- https://github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d
- https://github.com/SigNoz/signoz/releases/tag/v0.141.1
- https://github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/http_handler.go#L4073-L4086
- https://github.com/SigNoz/signoz
- https://www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-missing-authentication-on-trace-funnel-analytics-endpoints