# CVE-2026-57955: SigNoz SQL injection in alert-history endpoints

Source: https://junglewise.ai/threats/cve-2026-57955-signoz-sql-injection-in-alert-history-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-57955 · Severity: high · CVSS 8.5 · Published 2026-06-29

SigNoz, an open-source observability platform, is vulnerable to a security flaw in its alert history features. An authenticated user, even one with limited 'Viewer' permissions, can bypass security controls to run unauthorized database commands. This could allow an attacker to view sensitive system logs, performance metrics, and traces, or potentially launch further attacks against internal network services.

Technologies: [Signoz](https://junglewise.ai/threats/technologies/signoz). Vendors: [SigNoz](https://junglewise.ai/threats/vendors/signoz).

## Quick answers

**Is CVE-2026-57955 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57955 being exploited in the wild.

**How severe is CVE-2026-57955?** High severity, with a CVSS score of 8.5, published 29 June 2026.

**Which products and versions are affected?** Signoz through 0.130.1.

**Is there a fix for CVE-2026-57955?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57955 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57955?** Check whether you run Signoz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the 'alert-history' endpoints of SigNoz (specifically POST /api/v1/rules/{id}/history/stats and POST /api/v1/rules/{id}/history/overall_status). The vulnerability stems from the 'id' path parameter being interpolated directly into ClickHouse queries using fmt.Sprintf without proper UUID validation or parameterization. An authenticated attacker, including those with low-privileged 'Viewer' roles, can inject URL-encoded single quotes to break out of the SQL string literal. This allows for arbitrary query execution to read all stored traces, logs, and metrics, or the abuse of ClickHouse's url() function to conduct Server-Side Request Forgery (SSRF) against internal infrastructure. The issue is present in pkg/query-service/app/http_handler.go and pkg/query-service/app/clickhouseReader/reader.go.

## Affected products

- SigNoz signoz through 0.130.1

## Timeline

- 2026-05-23: disclosed: Initial outreach to vendor
- 2026-06-17: disclosed: Public GitHub issue opened
- 2026-06-29: advisory: CVE published and NVD entry created

## References

- [https://github.com/SigNoz/signoz/issues/11747](https://github.com/SigNoz/signoz/issues/11747)
- [https://www.vulncheck.com/advisories/signoz-sql-injection-in-alert-history-endpoints-via-rule-id-parameter](https://www.vulncheck.com/advisories/signoz-sql-injection-in-alert-history-endpoints-via-rule-id-parameter)

## Related threats

- [SigNoz session token revocation bypass on password reset and user deletion](https://junglewise.ai/threats/cve-2026-97056-signoz-versions-from-v0-98-0-up-to-but-not-including-v0-143-0)
- [SigNoz JWT tokenizer authentication bypass via empty signing secret](https://junglewise.ai/threats/cve-2026-97055-signoz-from-v0-8-0-before-v0-143-0-defaults-the-jwt-tokenizer)
- [SigNoz SQL injection in query_range API field-key names](https://junglewise.ai/threats/cve-2026-93426-signoz-sql-injection-in-query-range-api-field-key-names)
- [SigNoz SQL injection in trace-funnel analytics](https://junglewise.ai/threats/cve-2026-93292-signoz-sql-injection-in-trace-funnel-analytics)
- [SigNoz authorization bypass in trace-funnel analytics endpoints](https://junglewise.ai/threats/cve-2026-92729-signoz-authorization-bypass-in-trace-funnel-analytics-endpoints)