CVE-2026-93426 in SigNoz
Summary
by MITRE • 09/17/2026
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in SigNoz versions prior to 0.142.0 represents a critical injection flaw within the v5 query_range API endpoint. This security defect stems from an insufficient sanitization of user-supplied telemetry field-key names, which are intended to be used as identifiers or string literals within underlying database queries. The root cause lies in the application's failure to properly escape special characters such as backticks and single quotes when these inputs are incorporated into SQL statements executed by ClickHouse. This lack of input validation allows authenticated users with a Viewer role or higher privileges to manipulate the structure of the query, effectively breaking out of their intended context within the database command.
From a technical perspective, this vulnerability is classified under CWE-89, which covers Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attacker exploits this flaw by embedding malicious payloads directly into field names sent via the API. By using backticks to escape identifier contexts and quotes to break out of string literals, the adversary can append arbitrary ClickHouse SQL commands to the legitimate query. This technique allows for the execution of unintended database operations that were not authorized or anticipated by the application logic. The vulnerability is particularly severe because it does not require administrative privileges; a standard viewer account possesses sufficient access rights to interact with the API and trigger the injection, thereby lowering the barrier for exploitation significantly.
The operational impact of this vulnerability is substantial, as it grants attackers the ability to read sensitive system tables within ClickHouse. Since SigNoz relies on ClickHouse for storing telemetry data such as logs, metrics, and traces, an successful exploit can lead to the exfiltration of valuable organizational intelligence. Attackers can query internal metadata, access stored log entries containing potentially confidential information, or extract metric data that reveals details about system performance and architecture. This capability aligns with ATT&CK technique T1005, which describes Data from Local System Retrieval, as well as T1489, Service Stop, if the attacker chooses to disrupt availability by issuing destructive commands. The ability to read arbitrary tables undermines the confidentiality integrity of the entire observability platform, potentially exposing proprietary business logic or user data stored within the telemetry streams.
To mitigate this risk, organizations running affected versions must immediately upgrade SigNoz to version 0.142.0 or later, where these input validation and escaping mechanisms have been corrected. In addition to upgrading, it is advisable to implement strict role-based access control policies to ensure that only trusted users can interact with the query_range API. Network-level controls such as Web Application Firewalls should be configured to detect and block SQL injection patterns in HTTP request parameters, particularly within fields labeled as telemetry keys or names. Furthermore, database administrators should review ClickHouse user permissions to adhere to the principle of least privilege, ensuring that even if an application-layer vulnerability is exploited, the blast radius of potential data exfiltration is minimized by restricting direct access to sensitive system tables from application service accounts.