CVE-2026-93292

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.88.0 through 0.142.0

Description Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the service name and span name fields into ClickHouse string literals without proper escaping.

Recommendations Update SigNoz to version 0.142.1.