CVE-2026-93292 in SigNoz
Summary
by MITRE • 09/17/2026
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The security flaw identified in SigNoz versions ranging from 0.88.0 up to, but not including, version 0.142.1 represents a critical server-side vulnerability within the trace-funnel analytics module. This component is designed to process and visualize complex distributed tracing data, allowing users to define funnel steps based on specific service names and span identifiers. The core technical deficiency lies in how these user-supplied parameters are handled during query construction. Specifically, when generating SQL queries for ClickHouse, the application interpolates values such as service_name and span_name directly into string literals without applying proper escaping or parameterization techniques. This lack of input sanitization creates a classic injection vector where malicious actors can manipulate the structure of the underlying database command by injecting syntactically valid SQL code through specially crafted funnel step definitions.
From an operational perspective, this vulnerability allows authenticated attackers to achieve arbitrary query execution against the backend ClickHouse database. Because the application returns the results of these queries directly in HTTP responses, the impact extends beyond simple data exfiltration. An attacker can read sensitive information stored within the observability platform, including potentially confidential telemetry data from other services or internal infrastructure details that are exposed through trace spans. The ability to execute arbitrary SQL commands also opens the door for potential denial-of-service conditions if an attacker crafts queries designed to consume excessive computational resources on the database server, although the primary risk remains unauthorized data access and integrity compromise of the analytics pipeline.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-89, which classifies improper neutralization of special elements used in an SQL command, commonly known as SQL injection. The exploitation technique falls under MITRE ATT&CK tactic T1059, specifically subtechnique T1059.004 for Command and Scripting Interpreter interactions via database queries, although it is more accurately described within the context of data exfiltration techniques such as T1005 or direct SQL manipulation depending on the specific payload used. The vulnerability highlights a critical gap in input validation practices where developer convenience overrides security best practices by bypassing prepared statements in favor of string concatenation for dynamic query generation.
To mitigate this risk, organizations running affected versions must upgrade to SigNoz version 0.142.1 or later immediately, as the patch addresses these interpolation flaws by implementing proper parameterized queries and input sanitization mechanisms. Until an upgrade is feasible, administrators should enforce strict access controls on the trace-funnel endpoints, ensuring that only trusted users with minimal necessary privileges can define funnel steps. Additionally, deploying a Web Application Firewall may provide some level of protection by filtering out known SQL injection patterns in HTTP requests targeting these specific analytics APIs, although this is not a substitute for fixing the underlying code defect at its source.