CVE-2026-92729

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/SigNoz/signoz
https://github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/http_handler.go#L4073-L4086
https://github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d
https://github.com/SigNoz/signoz/pull/12817
https://github.com/SigNoz/signoz/releases/tag/v0.141.1
https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
https://www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-missing-authentication-on-trace-funnel-analytics-endpoints

Configurations

No configuration.

History

16 Sep 2026, 19:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 19:18

Updated : 2026-09-16 20:21

NVD link : CVE-2026-92729

Mitre link : CVE-2026-92729

CVE.ORG link : CVE-2026-92729

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

CWE-862

Missing Authorization

{"id": "CVE-2026-92729", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "SigNoz", "product": "signoz", "versions": [{"status": "affected", "version": "0.88.0", "lessThan": "0.141.1", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/SigNoz/signoz", "defaultStatus": "unaffected"}]}], "published": "2026-09-16T19:18:06.833", "references": [{"url": "https://github.com/SigNoz/signoz", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/http_handler.go#L4073-L4086", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SigNoz/signoz/pull/12817", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SigNoz/signoz/releases/tag/v0.141.1", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-missing-authentication-on-trace-funnel-analytics-endpoints", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials."}], "lastModified": "2026-09-16T20:21:01.047", "sourceIdentifier": "disclosure@vulncheck.com"}