Critical SQL Injection Vulnerabilities in SigNoz Exposed

• •CVE-2026-93426 and CVE-2026-93292 allow SQL injection via unescaped user inputs.
• •Exploits can lead to unauthorized data access in ClickHouse databases.
• •Immediate upgrades and access restrictions are recommended for affected SigNoz versions.

SigNoz versions 0.87.0 to 0.142.0 contain multiple SQL injection vulnerabilities, specifically CVE-2026-93426 and CVE-2026-93292, allowing authenticated users to execute arbitrary SQL queries through unescaped user inputs in telemetry field names and funnel definitions. Attackers can exploit these vulnerabilities to read sensitive data from ClickHouse databases, potentially exposing service topology, credentials, and operational data. The vulnerabilities were disclosed on September 17, 2026, and are classified as high-risk due to their potential impact on internet-facing or shared deployments. Immediate remediation is advised, including upgrading to fixed versions and restricting API access. The risk is particularly high for environments with poorly governed user accounts. No active exploitation has been confirmed yet, but the vulnerabilities are serious enough to warrant urgent attention.