CVE-2026-92729: SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-21
Weakness: CWE-306

Description

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.

Affected products

signoz: from 0.88.0 before 0.141.1 — fixed in 0.141.1

How to fix

Upgrade to a fixed version: signoz 0.141.1. Check the vendor advisory for mitigations.

References

https://github.com/SigNoz/signoz
https://github.com/SigNoz/signoz/blob/v0.141.0/pkg/query-service/app/http_handler.go#L4073-L4086
https://github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d
https://github.com/SigNoz/signoz/pull/12817
https://github.com/SigNoz/signoz/releases/tag/v0.141.1
https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
https://www.vulncheck.com/advisories/signoz-0.88.0-through-0.141.0-missing-authentication-on-trace-funnel-analytics-endpoints
https://github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5

Get alerted when CVE-2026-92729 or the next vulnerability affects your stack