Vulnerability Description
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/SigNoz/signoz
- https://github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/http_handle
- https://github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d
- https://github.com/SigNoz/signoz/pull/12817
- https://github.com/SigNoz/signoz/releases/tag/v0.141.1
- https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
- https://www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-missing-authe
FAQ
What is CVE-2026-92729?
CVE-2026-92729 is a vulnerability with a CVSS score of 8.2 (HIGH). SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions t...
How severe is CVE-2026-92729?
CVE-2026-92729 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92729?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.