Is CVE-2026-57956 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57956 being exploited in the wild.

How severe is CVE-2026-57956?

Medium severity, with a CVSS score of 6.4, published 29 June 2026.

Is there a fix for CVE-2026-57956?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57956 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57956?

Check whether you run Signoz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57956: SigNoz broken access control in alert rules

CVE-2026-57956 · Severity: medium · CVSS 6.4 · Published 2026-06-29

SigNoz is an open-source observability platform used by organizations to monitor application performance and set up alerts. A security flaw in its multi-tenant architecture allows a user from one organization to view, modify, or delete the alert rules of another organization. This could lead to the exposure of sensitive monitoring configurations or the unauthorized silencing of critical system alerts, potentially disrupting operations.

Technologies: Signoz. Vendors: SigNoz.

Quick answers

Is CVE-2026-57956 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57956 being exploited in the wild.
How severe is CVE-2026-57956?: Medium severity, with a CVSS score of 6.4, published 29 June 2026.
Which products and versions are affected?: Signoz through 0.130.1.
Is there a fix for CVE-2026-57956?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57956 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57956?: Check whether you run Signoz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability (Insecure Direct Object Reference) exists in SigNoz through version 0.130.1. The root cause is located in the alert rule store predicates (specifically within pkg/ruler/rulestore/sqlrulestore/rule.go), which fail to include organization ID (org_id) filters when performing Get, Edit, or Delete operations. An authenticated attacker with access to one tenant can manipulate the rule UUID in API requests to interact with rules belonging to other tenants. This allows for unauthorized cross-organization reading, modification, and deletion of alert rules in multi-tenant deployments. The vulnerability affects Cloud, Enterprise, and multi-org self-hosted instances, while single-tenant OSS instances are functionally unaffected.

Affected products

SigNoz SigNoz through 0.130.1

Timeline

2026-06-13: disclosed: Initial researcher report to vendor via email
2026-06-23: other: Public GitHub issue opened
2026-06-29: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.