CVE-2026-57955 Details

A SQL injection vulnerability has been identified in SigNoz versions through 0.130.1. This vulnerability allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. The affected endpoints are 'POST /api/v1/rules/{id}/history/stats' and 'POST /api/v1/rules/{id}/history/overall_status'. The vulnerability arises because the rule ID is passed directly into ClickHouse queries without proper validation or parameterization, enabling attackers to manipulate the query and access all stored traces, logs, and metrics. Additionally, if the ClickHouse server has outbound network access, the 'url()' function can be exploited to perform server-side request forgery.

The vulnerability can be remediated by validating the rule ID path parameter as a UUID before use and by employing ClickHouse's parameterized query interface for all user-supplied values.