SigNoz EUVD-2026-80942

Exploitation requires only network reachability to a SigNoz query-service instance (versions 0.88.0 through 0.141.0) whose trace-funnel analytics HTTP endpoints (/{funnel_id}/analytics/* and /analytics/* under the trace-funnels router) are exposed; no credentials, user interaction, or non-default configuration are needed because the routes shipped without any authorization wrapper. The primary limiting factor is network exposure - instances behind authentication proxies, VPNs, or not exposing the query-service port to the attacker are not reachable - and impact is bounded to read-only disclosure of trace/funnel analytics rather than data modification or full system compromise. Upgrading to 0.141.1 (or applying the ViewAccess wrappers) closes it.

This is a genuine priority-worthy exposure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes remote, unauthenticated, low-complexity information disclosure, and the vendor PR (#12817) independently confirms the root cause: twelve trace-funnel analytics routes were registered without the am.ViewAccess authorization wrapper, so PR:N is verified by source code, not merely asserted. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation yet - the 8.8 score reflects ease of access and confidentiality impact, not observed attacks. The vendor's VA:L (availability) rating is questionable: the vulnerability is a read-only authorization gap and any availability effect from arbitrary funnel queries is speculative; the real impact is confidentiality of observability data (service topology, trace identifiers, durations, error activity). VC:H is defensible but on the generous side since the leaked data is telemetry/metadata rather than primary secrets. Net: real, easily exploitable auth gap in an internet-facing observability tool - patch promptly - but not a confirmed mass-exploitation event.

An attacker who can reach a SigNoz instance's query-service HTTP port sends a POST request with an arbitrary funnel definition to a trace-funnel analytics endpoint (e.g. /analytics/overview) with no credentials. The server returns trace analytics - service topology, span counts, durations, and error activity - allowing the attacker to map the target's internal microservice architecture and identify error-prone components. No public exploit code was identified at time of analysis, but exploitation is trivial given the missing authorization wrapper confirmed in the patch.