CVE-2026-93292 SigNoz CVE debrief

Who should care

Defenders responsible for SigNoz deployments, especially those using versions between 0.88.0 and 0.142.1, should assess exposure and verify the effectiveness of their current security controls.

Why it matters

CVE-2026-93292 is a SQL injection vulnerability in SigNoz versions from 0.88.0 before 0.142.1 that allows authenticated attackers to execute arbitrary queries and read results in HTTP responses. Defenders should prioritize verifying exposure, assessing the effectiveness of current security controls, and implementing additional security controls to detect and prevent SQL injection attacks.

• Verify exposure in SigNoz deployments
• Assess the effectiveness of current security controls
• Implement additional security controls to detect and prevent SQL injection attacks
• Monitor for suspicious activity

Technical summary

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses. The vulnerability allows attackers to execute arbitrary queries, potentially leading to unauthorized data access and manipulation. Defenders should prioritize verifying exposure in SigNoz deployments, especially those using versions between 0.88.0 and 0.142.1, and assess the effectiveness of their current security controls.

Defensive priority

Defenders should prioritize verifying exposure in SigNoz deployments, especially those using versions between 0.88.0 and 0.142.1, and assess the effectiveness of their current security controls.

Recommended defensive actions

• Verify SigNoz version and assess exposure
• Review and restrict access to trace-funnel analytics endpoints
• Implement additional security controls to detect and prevent SQL injection attacks
• Monitor for suspicious activity and update to version 0.142.1 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source references indicate a SQL injection vulnerability in SigNoz versions from 0.88.0 before 0.142.1. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.