Vulnerability Description
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/SigNoz/signoz
- https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/apiserver/signozapiserver/que
- https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/querybuilder/fallback_expr.go
- https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/telemetrymetadata/field_mappe
- https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d
- https://github.com/SigNoz/signoz/commit/9c886be12015c43a1465af3532b3c3afbec6bebc
- https://github.com/SigNoz/signoz/releases/tag/v0.142.0
- https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc
- https://www.vulncheck.com/advisories/signoz-0.87.0-before-0.142.0-sql-injection-
- https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc
FAQ
What is CVE-2026-93426?
CVE-2026-93426 is a vulnerability with a CVSS score of 8.5 (HIGH). SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher...
How severe is CVE-2026-93426?
CVE-2026-93426 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93426?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.