CVE-2026-57955
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A SQL injection vulnerability in SigNoz through version 0.130.1 allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of alert-history endpoints. Attackers can read all stored traces, logs, and metrics or abuse the url() function for server-side request forgery (SSRF).
Risk Assessment
The risk includes full compromise of data monitored by SigNoz (traces, logs, metrics) and the ability to perform SSRF attacks on internal network resources, potentially leading to further privilege escalation.
Recommendation
Immediately upgrade SigNoz to a version newer than 0.130.1 that contains the fix. Until then, restrict access to alert-history endpoints to trusted users only.
Other vulnerabilities in SigNoz
See all- CVE-2026-63094High
An open redirect vulnerability in SigNoz before 0.134.0 in the SSO authentication flow. An unauthenticated attacker can steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC.
- CVE-2026-57956Medium
A vulnerability in SigNoz before version 0.133.0 allows authenticated users to access alert rules of other organizations by supplying a target rule UUID. The alert rule store lacks filtering by organization ID, bypassing multi-tenant access controls.
Original NVD description (English source)
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to perform server-side request forgery.