Executive brief
SigNoz is an open-source observability platform that provides application performance monitoring, distributed tracing, and log management. A SQL injection vulnerability in its trace-funnel analytics feature allows authenticated attackers to inject malicious SQL through funnel step definitions, potentially exposing sensitive monitoring data or disrupting analytics operations.
Technical details
The vulnerability is a SQL injection flaw in SigNoz's trace-funnel analytics endpoints that construct ClickHouse queries by directly interpolating service_name and span_name fields into string literals without proper escaping. Authenticated users can inject arbitrary SQL via funnel step definitions to execute queries against the ClickHouse backend and receive results in HTTP responses. The vulnerability affects versions 0.88.0 through 0.142.0, with a fix available in version 0.142.1. This is a server-side injection requiring authentication, allowing attackers with legitimate access to escalate privileges and read arbitrary data from the analytics database.
Affected products
- SigNoz SigNoz 0.88.0 to 0.142.0
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix available in version 0.142.1