CVEvulnerability
CVE-2026-92729
8.8 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-16
- Last modified
- 2026-09-21
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.8 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
- Weaknesses
- CWE-306, CWE-862
Description
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
Related
References
- https://github.com/SigNoz/signoz github.com
- https://github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/http_handler.go#L4073-L4086 github.com
- https://github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d github.com
- https://github.com/SigNoz/signoz/pull/12817 github.com
- https://github.com/SigNoz/signoz/releases/tag/v0.141.1 github.com
- https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5 github.com
- https://www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-missing-authentication-on-trace-funnel-analytics-endpoints www.vulncheck.com
- https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5 github.com