SigNoz CVE-2026-93426

Requires an authenticated SigNoz account with Viewer role or higher (PR:L) and network access to the SigNoz API on an affected version (0.87.0 up to but not including 0.142.0). The specific trigger is the v5 query_range API endpoint accepting a user-supplied telemetry field-key name that is not escaped before being embedded in generated ClickHouse SQL; the attacker embeds backticks and quotes to break out of identifier and string-literal contexts. No user interaction and no non-default configuration are needed - the flaw is present in the standard query builder path. The primary limiting factor is that valid low-privilege credentials are required, so exploitation is confined to authorized users, compromised accounts, or multi-tenant insiders rather than fully unauthenticated remote attackers.

This is a genuine priority for organizations running SigNoz. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H) describes network-reachable, low-complexity SQL injection requiring only low privileges (Viewer role), and the description confirms a concrete, ungated injection path in the v5 query_range API. The 8.4 score is well-supported: an authenticated user of the lowest role can reach ClickHouse and read system tables. Signal comparison is uneven, however - no EPSS score, no CISA KEV listing, and no confirmed weaponized public exploit were supplied, so there is currently no evidence of active exploitation. Offsetting that, the fix commits and a detailed VulnCheck advisory are public and the injection technique (backtick/quote breakout of identifiers) is well-understood and reproducible, which historically shortens time-to-exploit. Key limiter: exploitation requires valid application credentials (PR:L), so this is not an internet-wide unauthenticated mass-exploitation candidate but rather an insider/authenticated-tenant and post-credential-compromise risk. Missing data (EPSS/KEV/POC) is an absence-of-evidence, not evidence the flaw is low risk.

An attacker holding any SigNoz account with Viewer role or higher submits a v5 query_range request in which a telemetry field-key name contains backticks and quotes. Because the field key is concatenated into generated ClickHouse SQL without escaping, the payload breaks out of the identifier/string context and appends attacker-controlled SQL that reads ClickHouse system tables and exfiltrates their contents. No public weaponized exploit is identified at time of analysis, but the fix diff and VulnCheck advisory document the mechanism in detail.