Description
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
References8
- github.com/SigNoz/signoz
- github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/ht…
- github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862d…
- github.com/SigNoz/signoz/pull/12817
- github.com/SigNoz/signoz/releases/tag/v0.141.1
- github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
- www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-miss…
- github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
Metrics
- CVSS 3.1
-
8.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L - CVSS 4.0
-
8.8
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 48 · as of 8 November 2026
- CWE
- CWE-306CWE-862
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.