---
id: CVE-2026-93292
title: >-
  SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection
  vulnerability in trace-funnel analytics endpoints that interpolate
  service_name and span_name fields into ClickHouse string literals without
  escaping
summary: >-
  SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection
  vulnerability in trace-funnel analytics endpoints that interpolate
  service_name and span_name fields into ClickHouse string literals without
  escaping. Authenticated attac…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cwe:
  - CWE-89
vendor: SigNoz
product: signoz
affected:
  - signoz >= 0.88.0 < 0.142.1
published: '2026-09-17'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93292'
references:
  - url: 'https://github.com/SigNoz/signoz'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/modules/tracefunnel/clickhouse_queries.go#L498-L499
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SigNoz/signoz/blob/v0.142.0/pkg/query-service/app/http_handler.go#L4081-L4086
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SigNoz/signoz/commit/8286e787b296b291a26a14d20407a335fcfbac25
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d
    label: disclosure@vulncheck.com
  - url: 'https://github.com/SigNoz/signoz/releases/tag/v0.142.1'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/signoz-0.88.0-before-0.142.1-sql-injection-in-trace-funnel-analytics-query-builders
    label: disclosure@vulncheck.com
  - url: 'https://github.com/SigNoz/signoz/security/advisories/GHSA-w5pf-xwjh-vr5v'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.004
epssPercentile: 0.3137
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T20:53:09.251070Z'
ingestedAt: '2026-09-17T17:23:30.682Z'
---

## Overview

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.