CVE-2026-97055
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret to an empty string, and Config.Validate() does not reject the empty value, so a deployment without a configured secret signs and verifies session tokens with an empty HMAC key. An unauthenticated attacker who knows an existing user's ID can forge a valid session token for that user, including an administrator.
Risk Assessment
An unauthenticated attacker who knows a user ID can forge a session token and take over an administrator account, and a forged refresh token remains usable for its full lifetime (30 days by default).
Recommendation
Update SigNoz to version 0.143.0 or later, which requires a JWT secret and changes the default provider to opaque.
Other vulnerabilities in SigNoz
See all- CVE-2026-97056Medium
SigNoz versions from v0.98.0 up to v0.143.0, when configured with the opaque session tokenizer, do not revoke a user's existing login sessions when the user's password is reset with a reset token or when the user is deleted. An attacker who already holds a session token retains full access to the account, up to administrator, after a password reset until the token reaches its maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default).
- CVE-2026-93426High
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
- CVE-2026-93292High
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. An authenticated attacker can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
- CVE-2026-92729High
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
- CVE-2026-63094High
An open redirect vulnerability in SigNoz before 0.134.0 in the SSO authentication flow. An unauthenticated attacker can steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC.
- CVE-2026-57956Medium
A vulnerability in SigNoz before version 0.133.0 allows authenticated users to access alert rules of other organizations by supplying a target rule UUID. The alert rule store lacks filtering by organization ID, bypassing multi-tenant access controls.
- CVE-2026-57955High
A SQL injection vulnerability in SigNoz through version 0.130.1 allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of alert-history endpoints. Attackers can read all stored traces, logs, and metrics or abuse the url() function for server-side request forgery (SSRF).
Original NVD description (English source)
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to an empty string, and Config.Validate() does not reject the empty value, so a deployment that does not configure a secret starts up and both signs and verifies session tokens with an empty HMAC key. Because the JWT tokenizer was the default provider, any such deployment is affected. An unauthenticated attacker who knows the ID of an existing user can forge a valid session token for that user — including an administrator — by signing the id, orgId and email claims with an empty key; the organization ID (and whether an email is registered) can be obtained without authentication from /api/v2/sessions/context. A forged refresh token can be exchanged at /api/v2/sessions/rotate for a new token pair and cannot be revoked, so it remains usable for its full lifetime (30 days by default). Fixed in v0.143.0, which requires a JWT secret when the jwt provider is selected and changes the default provider to opaque.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS