CVE-2026-93292 json
SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders
published last mo. modified last mo. also EUVD-2026-82315 , GHSA-w5pf-xwjh-vr5v
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository SigNoz/signoz. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
Patch / fix
- SigNoz signoz 0.142.1
Is CVE-2026-93292 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N |
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
| CNA | 4.0 | 8.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- SigNoz signoz
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d
patch
-
github.com
/SigNoz/signoz/commit/8286e787b296b291a26a14d20407a335fcfbac25
patch
-
github.com
/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v
vendor-advisory, exploit, advisory
-
github.com
/SigNoz/signoz/releases/tag/v0.142.1
release-notes
-
github.com
/SigNoz/signoz/blob/v0.142.0/pkg/modules/tracefunnel/clickhouse_queries.go#L498-L499
technical-description
-
github.com
/SigNoz/signoz/blob/v0.142.0/pkg/query-service/app/http_handler.go#L4081-L4086
technical-description
-
github.com
/SigNoz/signoz
product
-
vulncheck.com
/advisories/signoz-0.88.0-before-0.142.1-sql-injection-in-trace-funnel-analytics-query-builders
third-party-advisory
Sources
- CVE List CVE-2026-93292
- NVD CVE-2026-93292
- Maintainer advisory GHSA-w5pf-xwjh-vr5v
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of SigNoz/signoz published their own advisory on GitHub. Reviewed sources take precedence over it.