{"id":"CVE-2026-93292","title":"SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping","summary":"SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attac…","severity":"high","cvss":8.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":["CWE-89"],"vendor":"SigNoz","product":"signoz","affected":["signoz >= 0.88.0 < 0.142.1"],"published":"2026-09-17","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:25:55.870","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93292","references":[{"url":"https://github.com/SigNoz/signoz","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/modules/tracefunnel/clickhouse_queries.go#L498-L499","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/query-service/app/http_handler.go#L4081-L4086","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/8286e787b296b291a26a14d20407a335fcfbac25","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/releases/tag/v0.142.1","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/signoz-0.88.0-before-0.142.1-sql-injection-in-trace-funnel-analytics-query-builders","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00304,"epssPercentile":0.23376,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-21T20:53:09.251070Z"},"ingestedAt":"2026-09-17T17:23:30.682Z","slug":"CVE-2026-93292","body":"## Overview\n\nSigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":59,"depthScoreParts":{"impact":46.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":208806,"id":"CVE-2026-93292","ts":1790027671231,"field":"exploit_available","old":"false","new":"true"}]}