CVE Alert: CVE-2026-93426 – SigNoz

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.

**Risk verdict:** High-risk exposure requiring prompt remediation; urgency should be raised to immediate if exploitation is confirmed, KEV-listed, or SSVC indicates active exploitation, none of which is supplied here.

**Why this matters:** A low-privilege account may turn the observability platform into a read gateway for sensitive telemetry and underlying ClickHouse metadata. Likely attacker objectives include discovering services, credentials or tokens in telemetry, mapping internal systems, and selectively altering query results or metadata; broad host compromise is not implied.

**Most likely attack path:** An attacker needs network access to the API and a valid account, but no special role, user interaction, or complex setup. With AV:N, AC:L, PR:L and UI:N, exploitation is practical through crafted query requests; Scope: Changed indicates potential impact beyond the directly vulnerable service, particularly where it can reach shared telemetry stores or connected environments.

**Who is most exposed:** Internet-facing or broadly accessible SigNoz deployments, shared multi-team observability platforms, and instances ingesting production logs, traces or security data are the priority population. Risk is higher where Viewer accounts are widely issued or federated identities are poorly governed.

Alert on unusual field-key syntax, quoting or backtick characters in query API requests.

Review ClickHouse audit logs for unexpected system-table reads or broad metadata enumeration.

Correlate query activity with new exports, spikes in telemetry reads, or access from unfamiliar identities.

Check API, proxy and identity logs for repeated failed-then-successful query attempts.

Mitigation and prioritisation:

Upgrade promptly to the vendor-fixed release; treat as priority 1 if KEV is true or EPSS is ≥0.5.

Restrict API access to trusted networks and enforce least-privilege, short-lived accounts.

Temporarily disable or tightly govern the affected query capability where operationally feasible.

Rotate exposed secrets and review telemetry retention and ClickHouse permissions after patching.

Validate in staging, then use an expedited change window with rollback and post-change query testing.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.