CVE-2026-92729 in SigNoz
Summary
by MITRE • 09/16/2026
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in SigNoz versions 0.88.0 through 0.141.0 represents a critical failure in access control mechanisms within the application's HTTP handler layer. Specifically, the trace-funnel analytics endpoints were implemented without applying necessary authorization wrappers or middleware checks that are standard for protected resources. This architectural oversight means that these specific API routes do not verify whether the requesting entity possesses valid authentication credentials or sufficient privileges before processing requests. As a result, any actor with network connectivity to the SigNoz instance can interact directly with these endpoints bypassing the intended security boundaries established by the application's design.
From a technical perspective, this flaw constitutes an Insecure Direct Object Reference combined with Broken Access Control. The server accepts and processes funnel definitions submitted via HTTP requests without validating the session state or token validity of the caller. This allows unauthenticated users to execute complex analytical queries against the underlying telemetry data store. By submitting arbitrary funnel configurations, attackers can trigger the execution of trace analytics logic that aggregates sensitive operational metrics. The system treats these unauthorized inputs as legitimate administrative actions due to the missing validation layer at the handler level.
The operational impact of this vulnerability is severe given the nature of observability platforms like SigNoz which aggregate vast amounts of production data. An attacker can retrieve detailed trace information including unique identifiers, request durations, span counts, service topology maps, and error activity logs. This exposure provides a comprehensive view of the internal architecture and performance characteristics of the target environment. Service topology details reveal how microservices communicate with one another, potentially exposing critical infrastructure dependencies that could be leveraged for lateral movement or targeted attacks against specific backend services. Furthermore, access to trace identifiers and duration data can facilitate reconnaissance efforts by mapping out active endpoints and identifying high-value targets based on traffic patterns.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-359 Exposure of Private Information within the Common Weakness Enumeration framework. In terms of offensive security tactics, it maps to ATT&CK technique T1078 Valid Accounts if credentials were compromised for further exploitation, but primarily falls under reconnaissance activities where an adversary gathers information about the target environment without detection. The ability to retrieve service topology and error activity specifically supports mapping network architecture which is a precursor step in many advanced persistent threat campaigns aimed at understanding system interdependencies before launching disruptive or exfiltrative actions.
Mitigation strategies must focus on immediate remediation of the codebase followed by broader security hardening measures. For organizations running affected versions, upgrading to version 0.142.0 or later is the primary and most effective solution as it addresses the missing authorization wrappers in the HTTP handler logic. Until an upgrade can be performed, network-level controls such as firewall rules should restrict access to these specific endpoints to trusted internal IP ranges only if public exposure cannot be avoided immediately. Additionally, implementing a Web Application Firewall with strict rule sets for observability platforms can help block unauthorized requests attempting to interact with analytics APIs without valid tokens. Regular security audits of API endpoint configurations are recommended to ensure that all state-changing or data-retrieving endpoints enforce consistent authentication and authorization checks across the entire application surface area.