CVE-2026-57955: SigNoz SQL Injection Vulnerability

CVE-2026-57955 Overview

CVE-2026-57955 is a SQL injection vulnerability affecting SigNoz through version 0.130.1. The flaw exists in the alert-history endpoints, where the rule ID path parameter is interpolated into ClickHouse queries without proper sanitization. Authenticated attackers can inject URL-encoded quotes into the rule ID parameter to execute arbitrary ClickHouse queries. Successful exploitation lets attackers read all stored traces, logs, and metrics collected by the observability platform. Attackers can also abuse the ClickHouse url() function to perform server-side request forgery (SSRF) against internal services. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can exfiltrate all telemetry data stored in SigNoz and pivot to internal networks through SSRF via the ClickHouse url() function.

Affected Products

SigNoz versions through 0.130.1
SigNoz alert-history API endpoints consuming the rule ID path parameter
Deployments backed by ClickHouse as the storage engine

Discovery Timeline

2026-06-29 - CVE-2026-57955 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57955

Vulnerability Analysis

SigNoz is an open-source observability platform that stores traces, logs, and metrics in ClickHouse. The alert-history endpoints accept a rule ID as a path parameter and use it to query historical alert state. The application interpolates this rule ID directly into ClickHouse SQL statements without parameterization or input validation. Authenticated users on the network can supply URL-encoded quote characters within the rule ID segment to break out of the intended SQL context. Once outside the intended query context, attackers append arbitrary ClickHouse statements that read from any table in the database. The confidentiality impact extends beyond alert metadata to every trace, log, and metric ingested by the platform.

Root Cause

The root cause is unsanitized string concatenation of the rule ID path parameter into a ClickHouse query. The endpoint handler does not use prepared statements or parameter binding when constructing the SQL. It also does not validate that the rule ID conforms to an expected format such as a UUID or numeric identifier. This design permits SQL metacharacters to reach the query engine and alter statement semantics.

Attack Vector

An attacker authenticates to SigNoz with any valid account, including low-privilege operator accounts. The attacker issues a crafted HTTP request to an alert-history endpoint, embedding URL-encoded single quotes (%27) and additional SQL clauses in the rule ID path segment. The injected payload executes with the privileges of the SigNoz application user against ClickHouse. Payloads using UNION SELECT read arbitrary tables containing telemetry data. Payloads using the ClickHouse url() table function issue outbound HTTP requests from the SigNoz server to attacker-chosen destinations, enabling SSRF against cloud metadata services or internal APIs. Verified proof-of-concept details are documented in the VulnCheck SQL Injection Advisory and GitHub Issue #11747.

Detection Methods for CVE-2026-57955

Indicators of Compromise

HTTP requests to alert-history endpoints containing URL-encoded quote characters (%27, %22) in the rule ID path segment.
ClickHouse query logs showing UNION, SELECT, or url( statements originating from the SigNoz service account against non-alert tables.
Outbound HTTP connections from the SigNoz server to unexpected destinations, particularly cloud metadata endpoints such as 169.254.169.254.
Anomalous access patterns from low-privilege SigNoz accounts targeting /api/v1/rules/*/history or similar alert-history routes.

Detection Strategies

Enable ClickHouse query_log and alert on queries containing the url() table function issued by the SigNoz application user.
Parse SigNoz application access logs for rule ID path parameters that do not match the expected UUID or numeric pattern.
Deploy a web application firewall rule that blocks encoded SQL metacharacters in path segments of alert-history routes.

Monitoring Recommendations

Baseline the set of ClickHouse tables normally queried by SigNoz and alert on queries touching other tables.
Monitor egress traffic from the SigNoz host and flag connections to internal RFC1918 ranges or cloud metadata IPs.
Track authentication events for SigNoz accounts and correlate with subsequent alert-history endpoint access.

How to Mitigate CVE-2026-57955

Immediate Actions Required

Upgrade SigNoz to a release later than 0.130.1 that addresses the rule ID sanitization issue once the vendor publishes a fix.
Restrict network access to SigNoz API endpoints so that only trusted operators can authenticate.
Rotate any credentials, tokens, or secrets that may have been logged as telemetry and accessed via SQL injection.
Review ClickHouse query_log for the presence of url() calls or unexpected SELECT statements since the deployment date.

Patch Information

Refer to GitHub Issue #11747 for the upstream tracking of the fix. Verify the resolved version and upgrade path against the VulnCheck SQL Injection Advisory before deploying to production.

Workarounds

Place SigNoz behind a reverse proxy that rejects requests where the rule ID path segment contains characters outside [A-Za-z0-9-].
Configure the ClickHouse user account used by SigNoz to deny access to the url() table function and restrict it to the minimum set of required tables.
Enforce network egress filtering on the SigNoz host to block outbound traffic to internal networks and cloud metadata services.
Reduce the number of authenticated SigNoz users and require multi-factor authentication on the identity provider fronting the platform.

bash

# Configuration example: restrict ClickHouse user privileges for SigNoz
# Apply on the ClickHouse server to limit the blast radius of SQL injection
REVOKE ALL ON *.* FROM signoz_user;
GRANT SELECT ON signoz_traces.* TO signoz_user;
GRANT SELECT ON signoz_logs.* TO signoz_user;
GRANT SELECT ON signoz_metrics.* TO signoz_user;
# Disallow the url() table function via user profile settings
# in users.xml:
#   <profiles><signoz_profile><readonly>2</readonly>
#     <function_restrictions><disallowed>url</disallowed></function_restrictions>
#   </signoz_profile></profiles>