EUVD-2026-82315

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...

CVE-2026-93292 SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...

CVE-2026-93292 SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...

CVE-2026-93292

SigNoz versions 0.88.0 through 0.142.0 contain a SQL injection vulnerability in the trace-funnel analytics endpoints. The root cause is the interpolation of service_name and span_name fields into ClickHouse string literals without escaping, as seen in the query builder code. An authenticated atta...

CVE-2026-93292: Improper Neutralization of Special Elements used in an SQL Command

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...