CVE-2026-93426
- Published17 Sept 2026
Description
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:NRemediation
No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.
References
- https://github.com/SigNoz/signoz
- https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/apiserver/signozapiserver/querier.go#L26
- https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/querybuilder/fallback_expr.go#L16-L22
- https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/telemetrymetadata/field_mapper.go#L79-L87
- https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d
- https://github.com/SigNoz/signoz/commit/9c886be12015c43a1465af3532b3c3afbec6bebc
- https://github.com/SigNoz/signoz/releases/tag/v0.142.0
- https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc
- https://www.vulncheck.com/advisories/signoz-0.87.0-before-0.142.0-sql-injection-in-v5-query-builder-field-key-names
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2026-93426 being actively exploited?
CVE-2026-93426 is not in the CISA KEV catalog.
How severe is CVE-2026-93426?
CVE-2026-93426 has a CVSS 3.1 base score of 8.5, rated high.
How do I fix CVE-2026-93426?
Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2026-93426 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.