CVE-2026-93426

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.87.0 through 0.141.0

Description Authenticated users with a Viewer role or higher can perform SQL injection by providing specially crafted telemetry field-key names. The application fails to properly escape these names in the 'v5 query range' API endpoint, allowing attackers to use backticks and quotes to break out of identifiers and string literals. This enables the execution of arbitrary ClickHouse SQL commands to access system tables and exfiltrate data.

Recommendations Update SigNoz to version 0.142.0 or later.