CVE-2026-93292: SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SigNozto a version that resolves this vulnerability.Fixed in 0.142.1Patch SQL Injection in Trace Funnel Analytics Query Builders
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with access to the trace-funnel analytics endpoints can exploit it. No user interaction is required, and the attack can be performed remotely.
What access does exploitation provide?
An attacker can inject SQL through funnel step service_name or span_name values, execute arbitrary ClickHouse queries, and read query results returned in HTTP responses. The reported impact includes high confidentiality impact and low integrity impact.
Which deployments are affected?
SigNoz versions from 0.88.0 up to, but not including, 0.142.1 are affected. Deployments running 0.142.1 or later are not identified as affected by the provided advisory data.
What should teams do if they cannot immediately upgrade?
The provided data does not identify a configuration workaround. Until upgrading, restrict access to authenticated users who need trace-funnel analytics access and review use of funnel step definitions containing unexpected service_name or span_name values.