Authorization Bypass in SigNoz Trace-Funnel Analytics

SigNoz versions 0.88.0 through 0.141.0 contain a critical authorization bypass vulnerability within the application's trace-funnel analytics endpoints. The vulnerability stems from a failure to implement necessary authorization wrappers on specific HTTP handlers responsible for processing trace-funnel requests. This oversight allows unauthenticated remote attackers to submit arbitrary funnel definitions to the API. By interacting with these unprotected endpoints, attackers can exfiltrate sensitive observability data, including trace identifiers, request durations, span counts, internal service topology, and error activity metrics. Because these endpoints do not validate user credentials, this vulnerability poses a significant risk for unauthorized information disclosure of internal system architecture and operational telemetry. Defending against this threat requires identifying and restricting access to the affected funnel analytics endpoints or upgrading to a patched version once available.

Impact

The vulnerability results in unauthorized exposure of sensitive operational data. Successful exploitation allows an attacker to map service dependencies, identify high-frequency error patterns, and monitor traffic volumes, which can be used to inform further reconnaissance against the internal network. No specific victim counts are currently available, but any organization running versions 0.88.0 through 0.141.0 is at risk of remote telemetry exfiltration.

Recommendation

• Monitor webserver access logs for anomalous POST requests directed at trace-funnel analytic endpoints originating from unauthorized IP ranges.
• Audit ingress traffic to identify unauthenticated requests to SigNoz API paths associated with trace analytics.
• Implement strict network-level access control (e.g., WAF rules or VPN-only access) for the SigNoz API until an upgrade to a patched version is completed.