CVE-2026-57956
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in SigNoz before version 0.133.0 allows authenticated users to access alert rules of other organizations by supplying a target rule UUID. The alert rule store lacks filtering by organization ID, bypassing multi-tenant access controls.
Risk Assessment
Attackers can read, edit, and delete alert rules belonging to other organizations, leading to data confidentiality and integrity breaches and potential disruption of monitored systems.
Recommendation
Immediately upgrade SigNoz to version 0.133.0 or later, which includes a fix for the broken access control vulnerability.
Other vulnerabilities in SigNoz
See all- CVE-2026-63094High
An open redirect vulnerability in SigNoz before 0.134.0 in the SSO authentication flow. An unauthenticated attacker can steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC.
- CVE-2026-57955High
A SQL injection vulnerability in SigNoz through version 0.130.1 allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of alert-history endpoints. Attackers can read all stored traces, logs, and metrics or abuse the url() function for server-side request forgery (SSRF).
Original NVD description (English source)
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.