CVE-2026-92729: SigNoz Authorization Bypass Vulnerability

CVE-2026-92729 Overview

CVE-2026-92729 is a missing authentication vulnerability [CWE-306] in SigNoz, an open-source observability platform. Versions 0.88.0 through 0.141.0 fail to wrap trace-funnel analytics endpoints in the HTTP handler with authorization middleware. Unauthenticated attackers can submit arbitrary funnel definitions over the network and retrieve trace analytics data. Exposed data includes trace identifiers, span durations, span counts, service topology, and error activity. No credentials, user interaction, or elevated privileges are required to trigger the flaw.

Critical Impact
Unauthenticated remote attackers can query internal application telemetry — including service maps and error traces — from any SigNoz deployment reachable over the network.

Affected Products

SigNoz 0.88.0 through 0.141.0
SigNoz query-service HTTP handler (pkg/query-service/app/http_handler.go)
Trace funnel analytics endpoints under /api/v1/trace-funnels/...

Discovery Timeline

2026-09-16 - CVE-2026-92729 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database
Fix released in SigNoz v0.141.1 via commit f78bd49 and Pull Request #12817
Advisory published as GHSA-v549-7j2x-qjm5

Technical Details for CVE-2026-92729

Vulnerability Analysis

SigNoz registers HTTP routes for trace funnel analytics inside pkg/query-service/app/http_handler.go. The affected route registrations bind handler functions such as handleValidateTraces, handleFunnelAnalytics, handleStepAnalytics, handleFunnelSlowTraces, and handleFunnelErrorTraces directly to the router. These registrations omit the am.ViewAccess authorization wrapper used elsewhere in the codebase. As a result, requests reach handler logic without any identity or role check. Attackers can POST arbitrary funnel definitions and receive back internal observability data describing services, traces, and application errors. The endpoints accept both path-scoped variants (/{funnel_id}/analytics/...) and payload-scoped variants (/analytics/...), both of which lacked authorization.

Root Cause

The root cause is a missing authorization control [CWE-306]. The router registers handlers without invoking am.ViewAccess(...), which is the middleware responsible for validating that the caller holds a valid session with view privileges. The handler code itself does not perform an independent authentication check, so requests without credentials execute the full analytics pipeline.

Attack Vector

Exploitation requires only network reachability to a vulnerable SigNoz instance. An attacker sends an HTTP POST request to any of the trace funnel analytics endpoints with a crafted funnel definition in the body. The server processes the request and returns trace identifiers, latency statistics, span counts, service topology, and error trace details. This exposes internal application behavior, deployed service inventory, and operational error data to unauthenticated third parties.

// Patch: pkg/query-service/app/http_handler.go
// Before (vulnerable): handlers registered without authorization
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/validate", aH.handleValidateTraces).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/overview", aH.handleFunnelAnalytics).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps", aH.handleStepAnalytics).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps/overview", aH.handleFunnelStepAnalytics).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/slow-traces", aH.handleFunnelSlowTraces).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/error-traces", aH.handleFunnelErrorTraces).Methods("POST")

// After (fixed): each handler wrapped with am.ViewAccess to enforce authorization
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/validate", am.ViewAccess(aH.handleValidateTraces)).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/overview", am.ViewAccess(aH.handleFunnelAnalytics)).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps", am.ViewAccess(aH.handleStepAnalytics)).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps/overview", am.ViewAccess(aH.handleFunnelStepAnalytics)).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/slow-traces", am.ViewAccess(aH.handleFunnelSlowTraces)).Methods("POST")
traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/error-traces", am.ViewAccess(aH.handleFunnelErrorTraces)).Methods("POST")

Source: SigNoz commit f78bd49

Detection Methods for CVE-2026-92729

Indicators of Compromise

HTTP POST requests to /api/v1/trace-funnels/*/analytics/validate, /analytics/overview, /analytics/steps, /analytics/steps/overview, /analytics/slow-traces, or /analytics/error-traces originating from unauthenticated sessions or unexpected IP addresses.
Requests to trace-funnel analytics endpoints missing an Authorization header or session cookie yet receiving 200 OK responses.
Anomalous spikes in outbound response sizes from the SigNoz query-service container on funnel analytics routes.

Detection Strategies

Inspect reverse-proxy or ingress logs for POST traffic to trace-funnel analytics paths and correlate against authenticated user sessions.
Alert on any request to these endpoints that succeeds without a valid bearer token or session identifier.
Baseline typical funnel-analytics usage per user and flag deviations, especially requests submitting inline funnel definitions rather than referencing existing funnel_id values.

Monitoring Recommendations

Enable access logging on the SigNoz query-service and forward logs to a central analytics store for retention and search.
Monitor the SigNoz version banner across environments to identify hosts still running 0.88.0 through 0.141.0.
Track egress from SigNoz hosts to detect exfiltration of large trace payloads.

How to Mitigate CVE-2026-92729

Immediate Actions Required

Upgrade all SigNoz deployments to v0.141.1 or later, which applies am.ViewAccess to every trace-funnel analytics route.
Restrict network exposure of SigNoz query-service so that only trusted internal networks or authenticated proxies can reach the HTTP API.
Audit access logs for prior unauthenticated requests to trace-funnel analytics endpoints and treat any hits as potential data exposure events.

Patch Information

The fix is delivered in SigNoz release v0.141.1 via commit f78bd49 merged through Pull Request #12817. Full technical details are published in GHSA-v549-7j2x-qjm5 and the VulnCheck advisory.

Workarounds

Place SigNoz behind an authenticating reverse proxy that requires a valid session cookie or bearer token before forwarding requests to /api/v1/trace-funnels/*.
Block external access to the trace-funnel analytics paths at the ingress or web application firewall until the upgrade is applied.
Restrict SigNoz query-service network policy to allow ingress only from application components that need it.

bash

# Example NGINX ingress rule to deny unauthenticated access to trace-funnel analytics
location ~* ^/api/v1/trace-funnels/.*/analytics/ {
    if ($http_authorization = "") { return 401; }
    proxy_pass http://signoz-query-service;
}
location ~* ^/api/v1/trace-funnels/analytics/ {
    if ($http_authorization = "") { return 401; }
    proxy_pass http://signoz-query-service;
}