CVE-2026-93426— SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names
Quick assessment
Affected
SigNoz signoz
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SigNoz 0.87.0 至 0.142.0 之前的版本在 v5 query_range API 中未对用户提供遥测字段键名进行转义处理，导致认证用户可以注入 SQL。拥有 Viewer 角色或更高权限的攻击者可以在字段名中嵌入反引号和引号，从而突破标识符和字符串字面量的边界，进而执行任意的 ClickHouse SQL 语句，读取系统表并窃取数据。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93426
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names
Source: CVE Program / CVE List V5
Vulnerability Description
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93426
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93426
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93426 (2)
Proof of Concept for CVE-2026-93426 (1)
Vendor Pages for CVE-2026-93426 (1)
-
🔗 Release v0.142.0 · SigNoz/signoz · GitHub release-notes
Other References for CVE-2026-93426 (1)
IV. Related Vulnerabilities
Same product: signoz
-
CVE-2026-93292
SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel -
CVE-2026-92729
SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Tr -
CVE-2026-63094
SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token -
CVE-2026-57956
SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object -
CVE-2026-57955
SigNoz 0.130.1 - SQL Injection in Alert History Endpoints vi
Same vendor: SigNoz
-
CVE-2026-93292
SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel -
CVE-2026-92729
SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Tr -
CVE-2026-63094
SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token -
CVE-2026-57956
SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object -
CVE-2026-57955
SigNoz 0.130.1 - SQL Injection in Alert History Endpoints vi
Same weakness: CWE-89
-
CVE-2026-53557
SQLBot: Second-Order SQL Injection via Excel Datasource Lead -
CVE-2026-53556
SQLBot: Authenticated SQL Injection in previewData Resulting -
CVE-2026-54597
ITFlow: Authenticated Time-Based Blind SQL Injection in ITFl -
CVE-2026-54596
ITFlow: Authenticated SQL Injection via recurring_invoice_fr -
CVE-2026-54354
MapServer: PostGIS Numeric Filter Value SQL Injection in Map
V. Comments for CVE-2026-93426
No comments yet