CVE-2026-93426
SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
| CWE | CWE-89 |
| Vendor | signoz |
| Product | signoz |
| Published | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for signoz signoz
Be the first to know when new high vulnerabilities affecting signoz signoz are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
SigNoz / signoz
0.87.0 < 0.142.0
References
github.com: https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc github.com: https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d github.com: https://github.com/SigNoz/signoz/commit/9c886be12015c43a1465af3532b3c3afbec6bebc github.com: https://github.com/SigNoz/signoz/releases/tag/v0.142.0 github.com: https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/querybuilder/fallback_expr.go#L16-L22 github.com: https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/telemetrymetadata/field_mapper.go#L79-L87 github.com: https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/apiserver/signozapiserver/querier.go#L26 github.com: https://github.com/SigNoz/signoz vulncheck.com: https://www.vulncheck.com/advisories/signoz-0.87.0-before-0.142.0-sql-injection-in-v5-query-builder-field-key-names
Credits
alexwaira tonghuaroot dodge1218 456789TZ