EUVD-2026-40140
GHSA-h37r-3qfp-73w6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authenticated low-priv user (PR:L) injects SQL; full telemetry read (C:H), SSRF crosses to other systems (S:C), limited integrity, no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to perform server-side request forgery.
AnalysisAI
SQL injection in SigNoz observability platform (versions through 0.130.1) lets authenticated, low-privileged users inject arbitrary ClickHouse queries through the unsanitized rule ID path parameter of the alert-history endpoints. By URL-encoding quote characters that break out of the interpolated rule ID, an attacker can read every stored trace, log, and metric, and can abuse ClickHouse's url() table function to pivot into server-side request forgery against internal services. This is CWE-89 with a documented SSRF secondary impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
SigNoz is an open-source application performance monitoring and observability backend that stores traces, logs, and metrics in ClickHouse, a columnar analytical database. The flaw lies in how the alert-history (rule history) HTTP endpoints take the rule ID from the URL path and interpolate it directly into a ClickHouse SQL statement without parameterization or sanitization, the classic root cause of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Because ClickHouse exposes the url() table function, the injection is not limited to data exfiltration: an attacker-controlled query can force the ClickHouse server to issue outbound HTTP requests, turning a SQLi into SSRF. The affected component is the SigNoz query-service/alert-history handler; no machine-readable CPE list was supplied beyond the 'through 0.130.1' version boundary in the description.
RemediationAI
No vendor-released patched version is identified in the available data; the references point to a VulnCheck advisory and to GitHub issue SigNoz/signoz#11747 rather than a tagged release, so upgrade to the latest SigNoz build above 0.130.1 once a fixed version is published and confirmed by the project, and monitor issue #11747 for the patch commit. As immediate compensating controls, restrict and audit who holds SigNoz accounts since exploitation requires authentication, and place the SigNoz UI/API behind network controls so only trusted operators can reach the alert-history endpoints - accepting that this reduces the convenience of broad read access. To blunt the SSRF vector, harden the ClickHouse layer by disabling or firewalling outbound network access from the ClickHouse server and restricting the url()/remote table functions via ClickHouse user profiles and the remote_url_allow_hosts allowlist; the trade-off is that any legitimate workflow relying on ClickHouse external-URL functions will break. Add monitoring/WAF rules to flag URL-encoded quote characters in rule ID path parameters of the alert-history routes, recognizing this is detection rather than a true fix.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today