Cpe:2.3:a:signoz:signoz:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asignozsignoz/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 19:52:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in SigNoz Trace-Funnel Analyticshttps://feed.craftedsignal.io/briefs/2026-09-signoz-auth-bypass/Wed, 16 Sep 2026 19:52:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-signoz-auth-bypass/SigNoz versions 0.88.0 through 0.141.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to query sensitive trace analytics via the trace-funnel endpoint.SigNoz versions 0.88.0 through 0.141.0 contain a critical authorization bypass vulnerability within the application's trace-funnel analytics endpoints. The vulnerability stems from a failure to implement necessary authorization wrappers on specific HTTP handlers responsible for processing trace-funnel requests. This oversight allows unauthenticated remote attackers to submit arbitrary funnel definitions to the API. By interacting with these unprotected endpoints, attackers can exfiltrate sensitive observability data, including trace identifiers, request durations, span counts, internal service topology, and error activity metrics. Because these endpoints do not validate user credentials, this vulnerability poses a significant risk for unauthorized information disclosure of internal system architecture and operational telemetry. Defending against this threat requires identifying and restricting access to the affected funnel analytics endpoints or upgrading to a patched version once available.

Impact

The vulnerability results in unauthorized exposure of sensitive operational data. Successful exploitation allows an attacker to map service dependencies, identify high-frequency error patterns, and monitor traffic volumes, which can be used to inform further reconnaissance against the internal network. No specific victim counts are currently available, but any organization running versions 0.88.0 through 0.141.0 is at risk of remote telemetry exfiltration.

Recommendation

  • Monitor webserver access logs for anomalous POST requests directed at trace-funnel analytic endpoints originating from unauthorized IP ranges.
  • Audit ingress traffic to identify unauthenticated requests to SigNoz API paths associated with trace analytics.
  • Implement strict network-level access control (e.g., WAF rules or VPN-only access) for the SigNoz API until an upgrade to a patched version is completed.
]]>highadvisoryauthorization-bypassapi-securityobservabilitysql-injectionvulnerabilityweb-applicationwebserverinjection