EUVD-2026-80942Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated access confirmed by patch (PR:N, AV:N, AC:L); impact is read-only disclosure of trace analytics so C:H, with no integrity or availability effect (I:N/A:N, rejecting vendor VA:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
AnalysisAI
Unauthenticated remote attackers can read trace and funnel analytics from SigNoz deployments running versions 0.88.0 through 0.141.0 because the trace-funnel analytics HTTP handlers were registered without any authorization wrapper. A single unauthenticated POST to endpoints under the trace-funnels router (both the /{funnel_id}/analytics/* and /analytics/* payload variants) returns identifiers, durations, span counts, service topology, and error activity, and because the payload-style handlers accept attacker-supplied funnel definitions, no pre-existing funnel or account is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to a SigNoz query-service instance (versions 0.88.0 through 0.141.0) whose trace-funnel analytics HTTP endpoints (/{funnel_id}/analytics/* and /analytics/* under the trace-funnels router) are exposed; no credentials, user interaction, or non-default configuration are needed because the routes shipped without any authorization wrapper. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority-worthy exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to SigNoz 0.141.1, the vendor-released patch version (https://github.com/SigNoz/signoz/releases/tag/v0.141.1), which restores the am.ViewAccess authorization wrapper on all twelve trace-funnel analytics route registrations as implemented in PR 12817 (https://github.com/SigNoz/signoz/pull/12817) and commit f78bd492d8732f011bc96837cf9862db2df0783d; the vendor advisory GHSA-v549-7j2x-qjm5 should be consulted for the authoritative fix guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every SigNoz deployment and determine which run versions 0.88.0 through 0.141.0, then immediately restrict network access to the query-service listener using firewall rules, security groups, VPN-only access, or an authenticating reverse proxy so that only trusted internal networks can reach it; also search logs for unexpected POST requests to trace-funnel analytics paths to assess whether disclosure has already occurred. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today