{"id":"CVE-2026-57955","summary":"SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter","details":"SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to perform server-side request forgery.","modified":"2026-07-16T03:30:48.864946694Z","published":"2026-06-29T17:22:22.444Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57955.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-89"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57955.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57955"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/signoz-sql-injection-in-alert-history-endpoints-via-rule-id-parameter"},{"type":"REPORT","url":"https://github.com/SigNoz/signoz/issues/11747"},{"type":"PACKAGE","url":"https://github.com/SigNoz/signoz"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/signoz/signoz","events":[{"introduced":"0"},{"fixed":"bc8c36095caf28dcc908787971a5bd4e6c5d0118"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"0.130.1"},{"fixed":"0.130.1"}]}}],"versions":["v0.130.0","v0.129.0","v0.128.0","v0.127.1","v0.127.0","v0.126.3-rc.1","v0.126.1","v0.126.0","v0.125.1","v0.125.0","v0.124.0","v0.123.0","v0.122.0","v0.121.1","v0.121.0","v0.120.0","v0.119.0","v0.118.0","v0.117.1","v0.117.0","v0.116.0","v0.116.1","v0.115.0","v0.114.1","v0.114.0","v0.113.0","v0.113.0-rc.1","v0.112.1","v0.112.0","v0.111.0","v0.110.1","v0.110.0","v0.109.3","v0.109.2","v0.109.1","v0.109.0","v0.108.0","v0.108.0-rc.1","v0.107.0","v0.106.0","v0.105.1","v0.105.0","v0.104.0","v0.104.0-cloud.1","v0.103.1","v0.103.0","v0.102.1","v0.102.0","v0.101.0","v0.101.0-rc.1","v0.100.1","v0.100.0","v0.99.0","v0.98.0","v0.98.0-rc.1","v0.98.0-rc.0","v0.97.1","v0.97.0","v0.97.0-rc.3","v0.97.0-rc.2","v0.97.0-rc.1","v0.96.1","v0.96.0","v0.95.1-cloud.1","v0.95.1","v0.95.0","v0.94.1-cloud.1","v0.94.0","v0.94.1","v0.93.0-cloud.3","v0.93.0-cloud.2","v0.93.0-cloud.1","v0.93.0","v0.93.0-rc.1","v0.93.0-rc.3","v0.93.0-rc.2","v0.92.2","v0.92.1","v0.92.0","v0.91.1","v0.92.0-rc.5","v0.92.0-rc.1","v0.92.0-cloud.1","v0.91.0","v0.90.1","v0.90.0","v0.89.0","v0.88.1","v0.88.0","v0.88.0-rc.1","v0.89.0-cloud.1","v0.88.0-cloud.3","v0.88.0-cloud.2","v0.88.0-cloud.1","v0.87.0-rc.1","v0.87.0","v0.86.2","v0.86.1","v0.86.0","v0.85.3","v0.85.2","v0.85.1","v0.85.0","v0.84.1","v0.84.0","v0.83.0","v0.83.0-cloud.1","v0.82.1","v0.82.0","v0.82.0-cloud.1","v0.81.0","v0.80.0","v0.79.1","v0.80.0-cloud.1","v0.79.0","v0.78.0","v0.78.1","v0.78.0-3142b6cc6","v0.78.0-cloud.1","v0.77.0","v0.77.0-cloud.2","v0.76.2-ac7ecac2","v0.76.2","v0.76.1","v0.77.0-cloud.1","v0.76.0","v0.76.0-cloud.4","v0.76.0-cloud.3","v0.76.0-cloud.2","v0.76.0-cloud.1","v0.75.0","v0.75.0-cloud.1","v0.74.0","v0.74.0-cloud.1","v0.73.0-407654e6","v0.73.0","v0.73.0-cloud.3","v0.73.0-cloud.2","v0.73.0-cloud.1","v0.72.0","v0.72.0-cloud.4","v0.72.0-cloud.3","v0.72.0-cloud.2","v0.72.0-cloud.1","v0.72.0-aws-integration-c3164912e","v0.71.0","v0.71.0-cloud.2","v0.70.1","v0.71.0-cloud.1","v0.70.0","histogram-quantile/v0.0.1","v0.69.0","v0.69.0-cloud.2","v0.69.0-cloud.1","v0.68.0","v0.67.1","v0.67.0","v0.67.0-custom-domain-15f85a645","v0.66.0","v0.65.1","v0.65.0-cloud.7","v0.65.0","v0.65.0-cloud.6","v0.65.0-cloud.5","v0.65.0-cloud.4","v0.65.0-cloud.3","v0.65.0-cloud.2","v0.64.0","v0.55.0","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.6","v0.3.5","0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.2.2","0.2.2","0.2.0","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57955.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N"}]}