CVE-2026-57955: SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to perform server-side request forgery.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57955?
CVE-2026-57955 has a high severity rating of 8.5.
How do I fix CVE-2026-57955?
To fix CVE-2026-57955, update SigNoz to version 0.130.2 or later.
What impact does CVE-2026-57955 have?
CVE-2026-57955 allows authenticated attackers to execute arbitrary ClickHouse queries due to SQL injection.
Which software is affected by CVE-2026-57955?
CVE-2026-57955 affects SigNoz versions up to and including 0.130.1.
What type of vulnerability is CVE-2026-57955?
CVE-2026-57955 is classified as an SQL Injection vulnerability.