CVE-2026-57955

Name of the Vulnerable Software and Affected Versions SigNoz versions prior to 0.130.2

Description Authenticated attackers can execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the 'alert-history' endpoints. This occurs because the rule ID is interpolated into ClickHouse queries without proper sanitization. This flaw allows attackers to read all stored traces, logs, and metrics, or utilize the url() function to perform server-side request forgery (SSRF), which is a technique used to induce a server to make requests to an unintended location.

Recommendations Update SigNoz to version 0.130.2 or later. As a temporary mitigation, restrict access to the 'alert-history' endpoints or avoid using the rule ID parameter until the update is applied.