CVE-2026-92729 Details
Description
SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.
A vulnerability exists in SigNoz versions 0.88.0 prior to 0.141.0, where trace funnel analytics endpoints lack proper authentication. This oversight allows unauthenticated users to send arbitrary funnel definitions and access trace analytics data, such as trace IDs, durations, span counts, service topology, and error activity, without any credentials. The issue arises because the analytics routes were registered without authorization wrappers, leaving them open to unauthorized access.
Users should upgrade to SigNoz version 0.141.1 or later, where this vulnerability has been patched. For those unable to upgrade immediately, it is recommended to block access to the vulnerable endpoints at the ingress or reverse proxy level.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SigNoz | >= 0.88.0, <= 0.141.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |