SigNoz vulnerabilities
We track 6 vulnerabilities in SigNoz products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 24, 2026.
Latest SigNoz vulnerabilities
- 8.1 High severity
signoz: Initialization of a Resource with an Insecure Default
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to an empty string, and Config.Validate() does not reject the empty value, so a deplo
- 8.5 High severity
signoz: Improper Neutralization of Special Elements used in an SQL Command
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out
- 8.5 High severity
signoz: Improper Neutralization of Special Elements used in an SQL Command
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL thr
- 8.2 High severity
signoz: Missing Authentication for Critical Functionality
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations,
- 8.1 High severity
signoz: Insufficient Verification of Data Authenticity
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenti
- 8.5 High severity
signoz: Improper Neutralization of Special Elements used in an SQL Command
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate t