Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92729SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints
High 8.2
In plain English
A high-severity missing authentication in signoz from SigNoz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 52.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
Affected products (as reported)
Weakness: CWE-306, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
References
- GitHub Security Advisory (GHSA-v549-7j2x-qjm5) vendor-advisory
- Pull Request #12817 patch, issue-tracking
- Patch Commit patch
- SigNoz v0.141.1 Release Notes release-notes
- RegisterTraceFunnelsRoutes analytics routes registered without an authorization wrapper technical-description
- https://github.com/SigNoz/signoz product
- VulnCheck Advisory: SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints third-party-advisory