Impact
Snuba is a core component of every Sentry deployment. A vulnerability in its Events Analytics Platform (EAP) query layer allowed certain user-supplied attribute input to be handled unsafely when building queries for the backing ClickHouse database. As a result, an authenticated user could cause unintended queries to run against the analytics store. On multi-tenant deployments this could lead to unauthorized access to data belonging to other organizations.
The affected code path is only reachable when the EAP array-attribute feature is enabled (the Sentry feature organizations:trace-item-details-array-fields). This feature is not enabled by default in self-hosted Sentry, so a default self-hosted installation is not exposed unless the feature has been explicitly turned on.
On SaaS (https://sentry.io) this vulnerability was patched on 2026-07-13, there was no indications that this issue was abused.
Patches
The issue is resolved in snuba 26.7.0 and self-hosted 26.7.0, which reworks the affected query path so attribute input is handled safely. Operators should upgrade to 26.7.0 or later. No configuration changes are required after upgrading.
Workarounds
If upgrading immediately is not possible:
- Ensure the array-attribute feature is not enabled — i.e. leave
organizations:trace-item-details-array-fields disabled. This is the default in self-hosted Sentry; it is controlled through SENTRY_FEATURES in your Sentry configuration, not through a UI setting.
- Restrict the ClickHouse account used for user-facing queries to read-only to limit potential impact.
These reduce exposure but are not a substitute for upgrading.
References
Ammar10317 Reporter
Impact
Snuba is a core component of every Sentry deployment. A vulnerability in its Events Analytics Platform (EAP) query layer allowed certain user-supplied attribute input to be handled unsafely when building queries for the backing ClickHouse database. As a result, an authenticated user could cause unintended queries to run against the analytics store. On multi-tenant deployments this could lead to unauthorized access to data belonging to other organizations.
The affected code path is only reachable when the EAP array-attribute feature is enabled (the Sentry feature
organizations:trace-item-details-array-fields). This feature is not enabled by default in self-hosted Sentry, so a default self-hosted installation is not exposed unless the feature has been explicitly turned on.On SaaS (https://sentry.io) this vulnerability was patched on 2026-07-13, there was no indications that this issue was abused.
Patches
The issue is resolved in snuba 26.7.0 and self-hosted 26.7.0, which reworks the affected query path so attribute input is handled safely. Operators should upgrade to 26.7.0 or later. No configuration changes are required after upgrading.
Workarounds
If upgrading immediately is not possible:
organizations:trace-item-details-array-fieldsdisabled. This is the default in self-hosted Sentry; it is controlled throughSENTRY_FEATURESin your Sentry configuration, not through a UI setting.These reduce exposure but are not a substitute for upgrading.
References