CVE-2026-93292
highSigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_nam…
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
CVSS
8.5
8.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-17 17:18
Modified: 2026-09-22 20:25
NVD status: Awaiting Analysis
Last synced 2 days ago
Verified against the source API 2026-10-27 06:54 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/SigNoz/signoz disclosure@vulncheck.com
- https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/modules/tracefunnel/clickhouse_queries.... disclosure@vulncheck.com
- https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/query-service/app/http_handler.go#L4081... disclosure@vulncheck.com
- https://github.com/SigNoz/signoz/commit/8286e787b296b291a26a14d20407a335fcfbac25 disclosure@vulncheck.com
- https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d disclosure@vulncheck.com
- https://github.com/SigNoz/signoz/releases/tag/v0.142.1 disclosure@vulncheck.com
- https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/signoz-0.88.0-before-0.142.1-sql-injection-in-trace-f... disclosure@vulncheck.com
- https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:54 UTC · record ↗