CVE-2026-93426CWE-89sql-injection

CVE-2026-93426

High · published September 18, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-18T02:17Z
References (10)
https://github.com/SigNoz/signoz · [email protected]https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/apiserver/signozapiserver/querier.go#L26 · [email protected]https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/querybuilder/fallback_expr.go#L16-L22 · [email protected]https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/telemetrymetadata/field_mapper.go#L79-L87 · [email protected]https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d · [email protected]https://github.com/SigNoz/signoz/commit/9c886be12015c43a1465af3532b3c3afbec6bebc · [email protected]https://github.com/SigNoz/signoz/releases/tag/v0.142.0 · [email protected]https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc · [email protected]https://www.vulncheck.com/advisories/signoz-0.87.0-before-0.142.0-sql-injection-in-v5-query-builder-field-key-names · [email protected]https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 21:19Z
    SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names
    cvelistv5