# CVE-2026-57956: SigNoz broken access control in alert rules

Source: https://junglewise.ai/threats/cve-2026-57956-signoz-broken-access-control-in-alert-rules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-57956 · Severity: medium · CVSS 6.4 · Published 2026-06-29

SigNoz is an open-source observability platform used by organizations to monitor application performance and set up alerts. A security flaw in its multi-tenant architecture allows a user from one organization to view, modify, or delete the alert rules of another organization. This could lead to the exposure of sensitive monitoring configurations or the unauthorized silencing of critical system alerts, potentially disrupting operations.

Technologies: [Signoz](https://junglewise.ai/threats/technologies/signoz). Vendors: [SigNoz](https://junglewise.ai/threats/vendors/signoz).

## Quick answers

**Is CVE-2026-57956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57956 being exploited in the wild.

**How severe is CVE-2026-57956?** Medium severity, with a CVSS score of 6.4, published 29 June 2026.

**Which products and versions are affected?** Signoz through 0.130.1.

**Is there a fix for CVE-2026-57956?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57956 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57956?** Check whether you run Signoz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability (Insecure Direct Object Reference) exists in SigNoz through version 0.130.1. The root cause is located in the alert rule store predicates (specifically within pkg/ruler/rulestore/sqlrulestore/rule.go), which fail to include organization ID (org_id) filters when performing Get, Edit, or Delete operations. An authenticated attacker with access to one tenant can manipulate the rule UUID in API requests to interact with rules belonging to other tenants. This allows for unauthorized cross-organization reading, modification, and deletion of alert rules in multi-tenant deployments. The vulnerability affects Cloud, Enterprise, and multi-org self-hosted instances, while single-tenant OSS instances are functionally unaffected.

## Affected products

- SigNoz SigNoz through 0.130.1

## Timeline

- 2026-06-13: disclosed: Initial researcher report to vendor via email
- 2026-06-23: other: Public GitHub issue opened
- 2026-06-29: advisory: NVD publication date

## References

- [https://github.com/SigNoz/signoz/issues/11830](https://github.com/SigNoz/signoz/issues/11830)
- [https://www.vulncheck.com/advisories/signoz-cross-organization-insecure-direct-object-reference-in-alert-rules](https://www.vulncheck.com/advisories/signoz-cross-organization-insecure-direct-object-reference-in-alert-rules)

## Related threats

- [SigNoz session token revocation bypass on password reset and user deletion](https://junglewise.ai/threats/cve-2026-97056-signoz-versions-from-v0-98-0-up-to-but-not-including-v0-143-0)
- [SigNoz JWT tokenizer authentication bypass via empty signing secret](https://junglewise.ai/threats/cve-2026-97055-signoz-from-v0-8-0-before-v0-143-0-defaults-the-jwt-tokenizer)
- [SigNoz SQL injection in query_range API field-key names](https://junglewise.ai/threats/cve-2026-93426-signoz-sql-injection-in-query-range-api-field-key-names)
- [SigNoz SQL injection in trace-funnel analytics](https://junglewise.ai/threats/cve-2026-93292-signoz-sql-injection-in-trace-funnel-analytics)
- [SigNoz authorization bypass in trace-funnel analytics endpoints](https://junglewise.ai/threats/cve-2026-92729-signoz-authorization-bypass-in-trace-funnel-analytics-endpoints)