Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-93292SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders
High 8.5
In plain English
A high-severity SQL injection in signoz from SigNoz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.4%top 65.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
References
- GitHub Security Advisory (GHSA-w5pf-xwjh-vr5v) vendor-advisory
- Partial fix, released 0.142.0 patch
- Residual two-step fix, released 0.142.1 patch
- SigNoz v0.142.1 Release Notes release-notes
- Residual unescaped interpolation at the last affected release technical-description
- The six affected analytics routes and their view-access wrapper technical-description
- https://github.com/SigNoz/signoz product
- VulnCheck Advisory: SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders third-party-advisory