high8.2
CVE-2026-92729
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler.
Impact
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
Affected products
| Product | Affected versions |
|---|---|
| SigNoz Versions 0.88.0 | through 0.141.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/SigNoz/signoz
- https://github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/http_handler.go#L4073-L4086
- https://github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d
- https://github.com/SigNoz/signoz/pull/12817
- https://github.com/SigNoz/signoz/releases/tag/v0.141.1
- https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
- https://www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-missing-authentication-on-trace-funnel-analytics-endpoints
- https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5