Critical SQL Injection and Authorization Bypass Vulnerabilities Disclosed

• •CVE-2026-93292 allows SQL injection in SigNoz, risking sensitive data exposure.
• •CVE-2026-92753 enables authorization bypass in PatrowlManager, affecting user alerts.
• •Both vulnerabilities are high-risk for internet-facing deployments and require urgent patching.

Two significant vulnerabilities have been disclosed affecting SigNoz and PatrowlManager. CVE-2026-93292 in SigNoz versions 0.88.0 to 0.142.1 allows low-privilege authenticated users to exploit SQL injection in trace-funnel analytics endpoints. This could lead to unauthorized access to sensitive telemetry and operational data. CVE-2026-92753 in PatrowlManager versions up to 1.8.4 permits authenticated attackers to bypass authorization, enabling them to read, delete, and modify alerts and events of other users. Both vulnerabilities are high-risk for internet-facing deployments, with exploitation paths requiring minimal effort and no elevated privileges. Current status indicates no confirmed active exploitation for either CVE, but urgent remediation is advised due to the potential impact on sensitive data and user trust.