SigNoz CVE-2026-93292

Requires an authenticated SigNoz account (PR:L) with access to the trace-funnel analytics feature, which exists only in versions 0.88.0 through 0.142.0. The concrete injection points are the service_name and span_name fields within funnel step definitions, which are interpolated into ClickHouse string literals without escaping. No user interaction is needed and the endpoint is network-reachable. The primary limiting factor is the authentication requirement - an attacker must already possess valid credentials (or exploit them via a compromised/insider/multi-tenant account); default-configuration unauthenticated exploitation is not possible.

Real, actionable risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/SC:H, score 8.4 High) describes a network-reachable, low-complexity SQL injection requiring only a low-privileged authenticated account and no user interaction - a class of flaw that is reliably weaponizable once a working request is known. The SC:H (subsequent-system confidentiality High) correctly reflects that injection lands in the backing ClickHouse datastore, a separate system, so a successful attack reads data well beyond the SigNoz app's own scope. No EPSS score, KEV listing, or POC was provided in the intelligence, so exploitation is 'no public exploit identified at time of analysis' - this is NOT active exploitation and should not be treated as such. The main mitigating factor is the PR:L authentication gate: the attacker must first hold a valid SigNoz account, which limits opportunistic mass exploitation but does nothing against insiders, compromised credentials, or multi-tenant deployments. VC:H with only VI:L/VA:L is consistent with the description ('read results in HTTP responses'), i.e. this is primarily a data-disclosure primitive rather than a destructive one. No signals conflict; the network vector, low complexity, and authenticated requirement are all internally consistent with the described attack.

An attacker with any authenticated SigNoz account opens the trace-funnel analytics feature and defines a funnel step whose service_name or span_name field contains a crafted single-quote-breaking SQL payload. Because those fields are interpolated directly into ClickHouse string literals without escaping, the injected SQL executes against the telemetry database and the query results are returned in the HTTP response, letting the attacker read arbitrary data. No public exploit code was identified in the provided intelligence, but the vulnerable code paths are pinpointed in the vendor advisory (clickhouse_queries.go and http_handler.go).