CVE-2026-93426: SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 queryrange API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SigNozto a version that resolves this vulnerability.Fixed in 0.142.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated SigNoz user with the Viewer role or a higher role can exploit it. The vulnerable path is the v5 query_range API.
What access and input are required for exploitation?
An attacker needs an authenticated account with at least Viewer permissions and must be able to supply telemetry field-key names to the v5 query builder. Malicious field names containing backticks and quotes can escape identifier and string-literal handling.
What could an attacker do after exploiting it?
The attacker can execute arbitrary ClickHouse SQL. The described impact includes reading system tables and exfiltrating data.
Which versions are affected?
SigNoz versions from 0.87.0 up to, but not including, 0.142.0 are affected. Upgrading to 0.142.0 or later addresses the affected version range.