CVE-2026-57956: SigNoz Broken Access Control in Alert Rules

Technical summary

The vulnerability stems from broken access control in SigNoz's alert rule data store layer. When processing requests to retrieve or modify alert rules, the underlying predicates do not properly filter results by organization ID before returning data or applying mutations. An authenticated attacker can bypass multi-tenant isolation by supplying the UUID of a target alert rule directly in API requests. Because the access control check is absent at the data store level rather than merely weak, standard RBAC patterns do not prevent cross-organization access. The vulnerability affects read, write, and delete operations on alert rules.

Business impact

For organizations running SigNoz in multi-tenant or shared environments, this vulnerability creates a confidentiality and integrity risk. Attackers with valid accounts—whether insider threats or compromised credentials from a low-privilege user—can discover and exfiltrate alert rule configurations belonging to other tenants, potentially revealing monitoring strategies, thresholds, and integration endpoints. Malicious modification or deletion of competitors' or partners' alert rules could degrade their observability and incident response capabilities. The integrity risk is particularly acute because changes may occur without audit trail clarity if logging is similarly affected.

Affected systems

SigNoz prior to version 0.133.0 is affected. The vulnerability applies to all deployments using alert rule functionality across versions before the patched release. Affected organizations should verify their running SigNoz version and assess whether their deployment model involves multiple tenants or user organizations sharing a single instance.

Exploitability

Exploitation requires valid authentication credentials and knowledge of a target alert rule's UUID. An attacker cannot exploit this vulnerability as an unauthenticated user. Once authenticated, discovering target UUIDs may be feasible through enumeration, error messages, or log inspection. The attack is deterministic and repeatable. The CVSS vector (AC:H) reflects the requirement for knowledge of target rule identifiers, but this should not be interpreted as high assurance against exploitation in environments with API logging or where UUIDs are predictable or disclosed through other means.

Remediation

Upgrade SigNoz to version 0.133.0 or later. This release includes corrected access control predicates that enforce organization ID filtering at the data store layer. Before upgrading, audit alert rules in your deployment for any unauthorized modifications or deletions. Review access logs to identify whether this vulnerability may have been exploited. In the interim, restrict network access to the SigNoz API to trusted internal networks and monitor for suspicious rule modification attempts.

Patch guidance

Verify the current running version of SigNoz in your environment. If it is earlier than 0.133.0, plan an upgrade to that version or later. Review SigNoz release notes and vendor advisories for any breaking changes or migration requirements specific to your deployment. Test the upgrade in a non-production environment first to confirm alert rule functionality and integrations remain intact. After upgrading, re-validate that cross-organization alert rule access is no longer possible by attempting to access rules from a different tenant context.

Detection guidance

Monitor SigNoz API logs for requests to alert rule endpoints (typically /api/v1/alerts/rules or similar) that reference rule UUIDs belonging to other organizations. Look for patterns where a single user account accesses rules associated with multiple organization IDs in a short time window. Enable and review audit logs for any modifications (PUT, PATCH, DELETE) to alert rules that do not align with normal administrative activity. If deploying a Web Application Firewall or API gateway in front of SigNoz, implement organization ID validation rules that block cross-tenant access attempts.

Why prioritize this

Although the CVSS base score is 6.4 (MEDIUM), the vulnerability merits prioritization in multi-tenant deployments because it directly violates tenant isolation—a foundational security property. The flaw affects alert rule integrity, which can impact incident response and monitoring. The ease of exploitation once authenticated, combined with the lack of special privileges required, means that compromised low-privilege accounts or insider threats pose a real risk. Environments with strict data separation requirements or regulatory obligations should treat this as high priority.

Risk score, explained

The CVSS:3.1 score of 6.4 reflects: (1) Network-accessible attack surface (AV:N), (2) High attack complexity due to the need to obtain valid credentials and identify target UUIDs (AC:H), (3) Low-privilege attacker requirement (PR:L, no admin role needed), (4) No user interaction required (UI:N), (5) Limited scope—the vulnerability does not escape the alert rules subsystem (S:U), (6) Low confidentiality impact (C:L, rules are moderately sensitive), (7) High integrity impact (I:H, rules can be modified or deleted), and (8) Low availability impact (A:L, deletion of rules degrades observability but does not crash the system). The medium rating appropriately balances the seriousness of broken tenant isolation against the authentication requirement.

Frequently asked questions