EUVD-2026-67089
GHSA-4pgr-wr6g-rxf6
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Adjacent network positioning on the proxy-to-ClickHouse hop required (AV:A, AC:H); no authentication needed to passively intercept; scope changes as ClickHouse backend data is exposed; no integrity or availability impact applies.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
Lifecycle Timeline
1DescriptionCVE.org
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.
AnalysisAI
TLS bypass in Grafana's ClickHouse Datasource plugin (versions 3.1.0 through 4.20.0) silently transmits database traffic in cleartext when the Native protocol is routed through a PDC or secure SOCKS proxy, despite TLS being configured. The underlying connection library ignores the TLS request without raising an error, exposing ClickHouse usernames, passwords, SQL queries, and query results to any attacker positioned on the network hop between the proxy and the database server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: the Grafana ClickHouse Datasource plugin must be configured to use the Native protocol (which is the default, so this condition is met in most standard deployments), AND the connection must be routed through a PDC (Private Data Connect) or secure SOCKS proxy - the TLS bypass does not occur on direct connections. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score with AV:A accurately reflects that exploitation is bounded to the network segment between the proxy egress point and the ClickHouse server - not freely accessible from the internet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Grafana ClickHouse Datasource plugin to a version beyond 4.20.0 per the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-19854; the advisory should specify the exact fixed release, which was not independently confirmed from the provided input data and should not be assumed from this analysis alone. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today