CVE-2026-97056: SigNoz Auth Bypass Vulnerability

CVE-2026-97056 Overview

CVE-2026-97056 is an insufficient session expiration vulnerability [CWE-613] affecting SigNoz observability platform versions from v0.98.0 up to (but not including) v0.143.0. When SigNoz is configured to use the opaque session tokenizer, the application fails to revoke active session tokens during password reset or user deletion operations. An attacker holding a valid session token retains full account access, up to administrator level, even after the account owner resets the password or the account is deleted. Tokens persist until their configured maximum lifetime expires (30 days by default) following password reset, or until the next rotation (30 minutes by default) following user deletion. SigNoz addressed the issue in v0.143.0.

Critical Impact
Password resets and user deletions do not terminate active sessions, enabling attackers with stolen tokens or offboarded users to retain administrator-level access to the SigNoz instance.

Affected Products

SigNoz versions v0.98.0 through v0.142.x using the opaque session tokenizer
SigNoz Community Edition deployments configured with opaque tokens
SigNoz Enterprise Edition deployments configured with opaque tokens

Discovery Timeline

2026-09-24 - CVE-2026-97056 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-97056

Vulnerability Analysis

The vulnerability resides in two SigNoz backend code paths that handle authentication state changes. The UpdatePasswordByResetPasswordToken handler, reachable via POST /api/v2/factor_password/reset, updates the user's password credential but never invalidates existing session tokens. Similarly, the DeleteUser handler, reachable via DELETE /api/v2/users/{id}, soft-deletes the user record without purging authentication artifacts.

Neither code path invoked the tokenizer's DeleteTokensByUserID method, leaving cached tokens and identity records intact in the opaque tokenizer store. This design flaw defeats two primary access-revocation workflows: credential rotation after suspected compromise, and account deactivation during offboarding.

Root Cause

The root cause is a missing session invalidation step [CWE-613] in authentication state transitions. The opaque session tokenizer maintains server-side state about active sessions but exposes a DeleteTokensByUserID function that the password reset and user deletion flows never called. Cached identities also persisted via a separate DeleteIdentity call that was absent from the deletion workflow.

Attack Vector

An attacker who already possesses a valid session token — for example from a stolen browser session, exfiltrated cookies, or a departing employee's cached credentials — can continue issuing authenticated API requests to the SigNoz instance. Password resets initiated by the legitimate user or administrator do not sever the attacker's session. Account deletion similarly fails to purge the active token until the next scheduled rotation cycle (default 30 minutes).

// Patch: pkg/modules/user/impluser/setter.go
// fix(user): revoke sessions when a user is deleted (#12943)
if err := module.store.RunInTx(ctx, func(ctx context.Context) error {
    if err := module.tokenizer.DeleteTokensByUserID(ctx, user.ID); err != nil {
        return err
    }

    if err := module.tokenizer.DeleteIdentity(ctx, user.ID); err != nil {
        return err
    }

    // for now we are only soft deleting users
    return module.store.SoftDeleteUser(ctx, orgID.String(), user.ID.StringValue())
}); err != nil {
    return err
}

Source: GitHub Commit e2e91739

Detection Methods for CVE-2026-97056

Indicators of Compromise

Authenticated API requests from a user account continuing after a successful POST /api/v2/factor_password/reset call for that same account.
API activity attributed to a user ID after a DELETE /api/v2/users/{id} request has been processed.
Session tokens issued before a password-reset timestamp still appearing in authentication logs beyond the reset event.

Detection Strategies

Correlate password reset events with subsequent authenticated request origins (IP address, user agent) to flag sessions that persist across credential changes.
Monitor for authentication activity tied to recently deleted user IDs within the 30-minute rotation window.
Audit the SigNoz tokenizer provider configuration to identify instances running the opaque provider on vulnerable versions.

Monitoring Recommendations

Enable detailed access logging on the SigNoz reverse proxy or ingress to retain source IP, token identifier, and user ID per request.
Forward SigNoz audit logs to a centralized SIEM for correlation of password reset and session usage events.
Alert on administrator-level API calls originating from sessions established prior to any recent credential change.

How to Mitigate CVE-2026-97056

Immediate Actions Required

Upgrade all SigNoz deployments to v0.143.0 or later, which revokes tokens on password reset and user deletion.
Restart the SigNoz backend after upgrade to flush any cached authentication state.
Rotate credentials and manually invalidate the tokenizer store for any user suspected of session compromise prior to patching.
Review recent offboarding and password reset events to identify accounts that may still have active tokens.

Patch Information

The fix is included in SigNoz v0.143.0. The patch adds explicit DeleteTokensByUserID and DeleteIdentity calls to both the user deletion flow and password reset flow, wrapped in a database transaction with the soft-delete operation. See the GitHub Security Advisory GHSA-xrgp-3fq4-xg83 and the VulnCheck Advisory on SigNoz for additional context. Commits b02aae2d, c122bc09, e2e91739, and faaed20d implement the fix.

Workarounds

If immediate upgrade is not possible, reduce the opaque tokenizer's maximum token lifetime to shorten the window of residual access.
Manually purge entries from the tokenizer store for any user following password reset or deletion.
Restrict administrative access to the SigNoz UI with network-level controls (VPN, IP allowlist) to limit exposure of stolen tokens.

bash

# Verify installed SigNoz version and upgrade
docker inspect signoz/query-service --format '{{.Config.Image}}'

# Pull and deploy the patched release
docker compose pull
docker compose up -d

# Confirm the running version is v0.143.0 or later
curl -s http://localhost:8080/api/v1/version