Executive brief
SigNoz, an open-source observability platform, is vulnerable to a security flaw in its alert history features. An authenticated user, even one with limited 'Viewer' permissions, can bypass security controls to run unauthorized database commands. This could allow an attacker to view sensitive system logs, performance metrics, and traces, or potentially launch further attacks against internal network services.
Technical details
A SQL injection vulnerability exists in the 'alert-history' endpoints of SigNoz (specifically POST /api/v1/rules/{id}/history/stats and POST /api/v1/rules/{id}/history/overall_status). The vulnerability stems from the 'id' path parameter being interpolated directly into ClickHouse queries using fmt.Sprintf without proper UUID validation or parameterization. An authenticated attacker, including those with low-privileged 'Viewer' roles, can inject URL-encoded single quotes to break out of the SQL string literal. This allows for arbitrary query execution to read all stored traces, logs, and metrics, or the abuse of ClickHouse's url() function to conduct Server-Side Request Forgery (SSRF) against internal infrastructure. The issue is present in pkg/query-service/app/http_handler.go and pkg/query-service/app/clickhouseReader/reader.go.
Affected products
- SigNoz signoz through 0.130.1
Timeline
- 2026-05-23: disclosed: Initial outreach to vendor
- 2026-06-17: disclosed: Public GitHub issue opened
- 2026-06-29: advisory: CVE published and NVD entry created