Executive brief
SigNoz is an open-source observability platform that collects and analyzes distributed traces, logs, and metrics from applications. Versions 0.88.0 through 0.141.0 fail to properly authenticate requests to trace analytics endpoints, allowing unauthenticated attackers to query sensitive trace data including service topology, error rates, and span details without credentials.
Technical details
The vulnerability is an authentication bypass in the HTTP handler for trace-funnel analytics endpoints. The authorization middleware wrapper is not applied to certain funnel analytics API routes, allowing unauthenticated HTTP requests to reach handler functions that process arbitrary funnel definitions. Attackers can submit crafted requests to extract detailed trace analytics data including trace identifiers, span durations, span counts, service topology information, and error activity. The affected versions are 0.88.0 through 0.141.0; patches are available in later versions.
Affected products
- SigNoz SigNoz 0.88.0 through 0.141.0
Timeline
- 2026-09-16: disclosed