Signoz Signoz
8 CVEs affecting Signoz Signoz. Latest disclosed: 2026-09-24. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93426 | High | 8.5 | 2026-09-17 | SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject… |
CVE-2026-93292 | High | 8.5 | 2026-09-17 | SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_nam… |
CVE-2026-57955 | High | 8.5 | 2026-06-29 | SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-enco… |
CVE-2026-92729 | High | 8.2 | 2026-09-16 | SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers… |
CVE-2026-97055 | High | 8.1 | 2026-09-24 | SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIG… |
CVE-2026-63094 | High | 8.1 | 2026-07-17 | SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from… |
CVE-2026-97056 | Medium | 6.8 | 2026-09-24 | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0… |
CVE-2026-57956 | Medium | 6.4 | 2026-06-29 | SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a… |