Description

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-17T22:17:04.597Z",
  "pubdate": "2026-09-17T22:17:04.597Z",
  "executiveSummary": "SigNoz versions 0.87.0 through 0.141.0 contain a critical SQL injection vulnerability within the v5 query_range API. This vulnerability arises from the improper sanitization of user-supplied telemetry field-key names, which are subsequently processed by the ClickHouse database backend.\nAn authenticated user with a role of Viewer or higher can exploit this flaw to inject malicious SQL commands, including backticks and string delimiters, to escape intended identifier contexts. By breaking out of these constraints, an attacker can execute arbitrary SQL queries against the underlying ClickHouse database.\nThe potential impact includes unauthorized access to system tables, exfiltration of sensitive telemetry data, and potential metadata compromise. This flaw represents a significant security risk for environments where SigNoz is deployed, as it bypasses authorization controls intended to restrict data access to specific project scopes. Exploitation does not require elevated administrative privileges, only standard authenticated access, making it accessible to a wide range of internal users.",
  "technicalDetails": "The root cause of the vulnerability is insufficient input validation and improper escaping of user-provided field-key names within the v5 query_range API implementation. When the SigNoz backend constructs ClickHouse queries based on parameters supplied by the client, it fails to treat these field names as untrusted data, instead concatenating them directly into the query string.\nThe vulnerability manifests as an SQL injection flaw targeting the ClickHouse database engine. Attackers can leverage the API request parameters to supply malicious field-key names containing SQL control characters, specifically backticks (`) and single quotes ('). By manipulating these characters, an attacker can prematurely terminate the expected identifier string and append arbitrary SQL logic. For example, by closing an identifier or string literal, the attacker can inject clauses such as UNION SELECT, enabling access to internal system tables or data belonging to other telemetry projects.\nThe attack flow proceeds as follows: First, the attacker authenticates to the SigNoz application. Second, the attacker crafts a malicious request to the v5 query_range endpoint, populating a field-key parameter with a payload designed to break the SQL syntax. Third, the SigNoz backend receives this input and injects the payload directly into the ClickHouse query generation process. Fourth, the ClickHouse database parses the malformed query, executing the injected instructions with the privileges of the application's database connection user.\nThe vulnerable component is the query builder logic within the SigNoz API layer responsible for translating telemetry queries into ClickHouse syntax. The affected versions span from 0.87.0 to 0.141.0. Because the application processes these queries server-side, the risk is concentrated in the backend interaction with ClickHouse. Successful exploitation allows for unauthorized data exfiltration, as the attacker can read from any table the database user has permissions to access, including system information that may further expose the infrastructure architecture. No specific network exposure beyond the standard application API access is required, and the exploitation is entirely within the application-to-database communication layer."
}