CVE-2026-57956: SigNoz Auth Bypass Vulnerability

CVE-2026-57956 Overview

CVE-2026-57956 is a broken access control vulnerability in SigNoz through version 0.130.1. The alert rule store fails to filter queries by organization ID, allowing authenticated users to access alert rules belonging to other organizations by supplying a target rule UUID. Attackers can read, edit, and delete alert rules across tenant boundaries, bypassing multi-tenant access controls. The flaw is classified as an Insecure Direct Object Reference [CWE-639] affecting cross-organization isolation in SigNoz observability deployments.

Critical Impact
Authenticated users in one organization can read, modify, and delete alert rules belonging to any other organization on the same SigNoz instance, breaking tenant isolation in shared deployments.

Affected Products

SigNoz observability platform through version 0.130.1
Multi-tenant SigNoz deployments serving multiple organizations
Self-hosted and shared SigNoz instances with alert rule functionality enabled

Discovery Timeline

2026-06-29 - CVE-2026-57956 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57956

Vulnerability Analysis

SigNoz is an open-source observability platform providing metrics, traces, logs, and alerting. The platform supports multi-tenancy by scoping resources such as alert rules to organizations. CVE-2026-57956 breaks this isolation model within the alert rule store layer.

The alert rule store retrieves records using a rule UUID supplied by the requesting user. The store's query predicates do not include the caller's organization ID as a filter condition. As a result, any authenticated user who obtains or guesses a valid rule UUID can act on that rule regardless of which organization owns it.

The vulnerability enables three cross-tenant operations: reading alert rule definitions, editing rule logic and thresholds, and deleting rules entirely. This exposes alerting configurations and allows attackers to suppress alerts in victim organizations by disabling or removing detection rules.

Root Cause

The root cause is a missing tenant isolation check in the alert rule store's query predicates. Authorization logic verifies that the caller is authenticated but does not verify that the target rule belongs to the caller's organization. This is a textbook Insecure Direct Object Reference where server-side authorization relies on object identifier secrecy rather than explicit ownership checks.

Attack Vector

An attacker requires a valid authenticated session in any organization on the target SigNoz instance. The attacker then issues API requests to alert rule endpoints substituting UUIDs belonging to rules in other organizations. Because the store queries do not filter by organization ID, the backend returns or modifies the cross-tenant rule. UUIDs may be obtained through information disclosure, log leaks, or systematic enumeration.

The vulnerability manifests in the alert rule store's data access layer. See the VulnCheck Security Advisory and GitHub Issue #11830 for technical details on the affected code paths.

Detection Methods for CVE-2026-57956

Indicators of Compromise

Alert rule API requests where the rule UUID does not correlate with any rule created by users in the caller's organization
Unexpected modifications, deletions, or disablement of alert rules without corresponding change tickets
Access log entries showing a single authenticated user interacting with alert rule UUIDs across multiple organization contexts

Detection Strategies

Correlate alert rule API access logs against the alert rule ownership table to flag any request where the caller's organization ID does not match the target rule's organization ID
Baseline normal alert rule modification patterns per user and alert on deviations such as bulk edits or deletions
Monitor for enumeration behavior against /api/v1/rules/{id} style endpoints, including sequential or high-volume UUID lookups

Monitoring Recommendations

Enable audit logging on all alert rule create, read, update, and delete operations with caller identity and organization context
Forward SigNoz application logs to a centralized SIEM for cross-tenant access correlation
Track alert rule inventory counts per organization and alert on unexpected reductions that may indicate malicious deletion

How to Mitigate CVE-2026-57956

Immediate Actions Required

Upgrade SigNoz to a patched release once available from the maintainers and monitor GitHub Issue #11830 for fix status
Audit existing alert rules for unauthorized modifications or deletions across all organizations on shared instances
Restrict authenticated access to trusted users only and review recent alert rule activity in application logs
Isolate multi-tenant SigNoz deployments by hosting separate instances per organization until a patch is applied

Patch Information

At the time of publication, the vulnerability affects SigNoz through version 0.130.1. No fixed version is listed in the NVD entry. Track the upstream fix through GitHub Issue #11830 and the VulnCheck Security Advisory.

Workarounds

Deploy separate SigNoz instances per organization to eliminate cross-tenant exposure until a patched version is released
Restrict network access to the SigNoz API to a limited set of trusted administrators via reverse proxy or network policy
Rotate and tightly scope API tokens, revoking any tokens held by users who do not require alert rule management

bash

# Configuration example: restrict SigNoz API access at the reverse proxy layer
# nginx snippet limiting alert rule endpoints to trusted admin CIDR ranges
location /api/v1/rules {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny all;
    proxy_pass http://signoz-backend;
}