CVE-2026-57955: SigNoz SQL Injection via Alert History Endpoint—Patch & Detection Guide

Technical summary

CVE-2026-57955 is a SQL injection vulnerability in SigNoz's alert-history endpoints where the rule ID path parameter is interpolated unsanitized into ClickHouse queries. The vulnerability stems from insufficient input validation on URL-encoded quote characters, allowing authenticated attackers to break out of the intended query context. The injected ClickHouse payload can abuse SQL functions, including url(), to perform server-side request forgery. The attack surface is confined to authenticated sessions, but lateral movement and data exfiltration risks are substantial given access to the full observability data layer.

Business impact

Compromise of a SigNoz instance exposes the entire observability data pipeline—traces, logs, and metrics from monitored applications. For organizations using SigNoz to monitor production systems, this enables attackers to map application behavior, extract sensitive debug information, identify architecture patterns, and potentially discover credentials or API keys embedded in logs. The SSRF capability via ClickHouse's url() function permits attackers to probe or interact with internal networks and services from the database context, circumventing network segmentation. Incident response, compliance audits, and customer trust are at risk if observability data is tampered with or exfiltrated.

Affected systems

SigNoz versions through 0.130.1 are affected. The vulnerability is specific to the alert-history API endpoints and requires an authenticated session. Organizations running self-hosted SigNoz deployments should prioritize patching. Cloud-hosted or managed SigNoz instances should be verified with the vendor for patch status and timeline.

Exploitability

Exploitation requires valid SigNoz credentials, setting the attack complexity to low once authenticated access is obtained. No user interaction is necessary; attackers can directly craft malicious HTTP requests to the alert-history endpoints with injected URL-encoded quotes in the rule ID parameter. The attack is deterministic and does not rely on race conditions or timing. The CVSS score of 8.5 reflects the high confidentiality impact (full data access) and the ability to scope beyond the vulnerable component via SSRF.

Remediation

Upgrade SigNoz to a patched version released after 0.130.1. Verify the exact version number and release date in the official SigNoz security advisory and release notes. In the interim, restrict network access to SigNoz instances to trusted networks, enforce strong authentication, and monitor query logs for suspicious ClickHouse activity. Consider isolating the SigNoz database from access to external networks to limit SSRF impact.

Patch guidance

Consult the official SigNoz security advisory and release notes to identify the patched version number and upgrade procedure. Most deployments using container images should pull the latest secure tag and redeploy. For binary or source installations, follow the vendor's documented upgrade steps, which typically include backing up configuration and data before applying updates. Test patches in a non-production environment first to verify compatibility with existing alert rules and integrations.

Detection guidance

Monitor SigNoz and ClickHouse logs for unusual query patterns, particularly those containing SQL keywords or ClickHouse functions (e.g., url()) in the rule ID context. Alert on failed authentication attempts followed by rapid rule ID parameter changes. Network-based detection should flag outbound connections initiated from the ClickHouse process to unexpected external hosts, which would indicate SSRF exploitation. Review access logs for authenticated users accessing alert-history endpoints with URL-encoded special characters in the rule ID.

Why prioritize this

HIGH priority due to authentication bypass of data confidentiality controls, high-impact data exfiltration capability, and potential for lateral network reconnaissance via SSRF. Organizations where SigNoz is internet-facing or accessible from untrusted networks should patch immediately. Even in internal-only deployments, the ability to exfiltrate observability data undermines security visibility and compliance posture.

Risk score, explained

The CVSS 3.1 score of 8.5 reflects: (1) Network-accessible attack vector with low attack complexity, (2) Authentication requirement that moderates but does not eliminate risk, (3) High confidentiality impact from unrestricted data access, (4) Limited but non-zero integrity impact from potential log or metric manipulation, (5) Scope change to other components via SSRF. The score does not include availability impact, as the vulnerability does not directly cause denial of service, though resource exhaustion via malicious queries is theoretically possible.

Frequently asked questions