← Back to CVE List
CVE-2026-93292NVD
Vulnerability Summary
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
CVSS v4.0 Base Metrics — Score 8.4 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)Low
Availability (Vulnerable System)None
Confidentiality (Subsequent System)High
Integrity (Subsequent System)Low
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 8.5 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityLow
AvailabilityNone
Affected & Patched Versions
- SigNoz signoz >= 0.88.0 and < 0.142.1
- SigNoz signoz 0.142.1
External References
- https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v
- https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d
- https://github.com/SigNoz/signoz/commit/8286e787b296b291a26a14d20407a335fcfbac25
- https://github.com/SigNoz/signoz/releases/tag/v0.142.1
- https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/modules/tracefunnel/clickhouse_queries.go#L498-L499
- https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/query-service/app/http_handler.go#L4081-L4086
- https://github.com/SigNoz/signoz
- https://www.vulncheck.com/advisories/signoz-0.88.0-before-0.142.1-sql-injection-in-trace-funnel-analytics-query-builders