Skip to content
OpenAdvisories

Vendor

SigNoz

8 known vulnerabilities.

Products

signoz 8
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.1
    CVE-2026-97055

    SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

    SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to an empty string, and Config.Validate() does not reject the empty value, so a depl…

    SigNoz signoz
  • High 8.5
    CVE-2026-93426

    SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names

    SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out…

    SigNoz signoz
  • High 8.5
    CVE-2026-93292

    SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

    SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL th…

    SigNoz signoz
  • High 8.2
    CVE-2026-92729

    SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints

    SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations…

    SigNoz signoz
  • High 8.1
    CVE-2026-63094

    SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

    SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthent…

    SigNoz signoz
  • High 8.5
    CVE-2026-57955

    SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter

    SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate …

    SigNoz signoz