CVE-2026-97056
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
SigNoz versions from v0.98.0 up to v0.143.0, when configured with the opaque session tokenizer, do not revoke a user's existing login sessions when the user's password is reset with a reset token or when the user is deleted. An attacker who already holds a session token retains full access to the account, up to administrator, after a password reset until the token reaches its maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default).
Risk Assessment
Password reset or user deletion does not terminate access, allowing an attacker prolonged unauthorized access to the account and potentially sensitive data.
Recommendation
Upgrade SigNoz to version v0.143.0 or later. After password reset or user deletion, manually revoke all session tokens.
Other vulnerabilities in SigNoz
See all- CVE-2026-97055High
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret to an empty string, and Config.Validate() does not reject the empty value, so a deployment without a configured secret signs and verifies session tokens with an empty HMAC key. An unauthenticated attacker who knows an existing user's ID can forge a valid session token for that user, including an administrator.
- CVE-2026-93426High
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
- CVE-2026-93292High
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. An authenticated attacker can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
- CVE-2026-92729High
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
- CVE-2026-63094High
An open redirect vulnerability in SigNoz before 0.134.0 in the SSO authentication flow. An unauthenticated attacker can steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC.
- CVE-2026-57956Medium
A vulnerability in SigNoz before version 0.133.0 allows authenticated users to access alert rules of other organizations by supplying a target rule UUID. The alert rule store lacks filtering by organization ID, bypassing multi-tenant access controls.
- CVE-2026-57955High
A SQL injection vulnerability in SigNoz through version 0.130.1 allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of alert-history endpoints. Attackers can read all stored traces, logs, and metrics or abuse the url() function for server-side request forgery (SSRF).
Original NVD description (English source)
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS