ClickHouse Datasource EUVD-2026-67089

Exploitation requires two concurrent conditions: the Grafana ClickHouse Datasource plugin must be configured to use the Native protocol (which is the default, so this condition is met in most standard deployments), AND the connection must be routed through a PDC (Private Data Connect) or secure SOCKS proxy - the TLS bypass does not occur on direct connections. The attacker must be network-adjacent to the hop between the proxy egress and the ClickHouse server endpoint (AV:A), meaning they require access to that specific network segment; generic internet-based attackers are excluded. AC:H reflects that achieving and maintaining the required interception position involves meaningful technical effort. Deployments using the HTTP transport protocol for ClickHouse rather than the Native protocol are not affected by this vulnerability.

The CVSS 6.1 score with AV:A accurately reflects that exploitation is bounded to the network segment between the proxy egress point and the ClickHouse server - not freely accessible from the internet. AC:H further constrains the attack, requiring the adversary to achieve and sustain a network-interception position on that specific hop, which limits opportunistic mass exploitation. However, S:C combined with C:H is a serious signal: a positioned attacker gains full visibility into authentication credentials and all database traffic with no cryptographic barrier whatsoever. No EPSS score was provided in the input data, making quantitative probability assessment impossible here; the absence of a KEV listing and any known public exploit suggests this is not currently being actively targeted at scale. Real-world risk is highest in cloud or shared-infrastructure environments where the proxy-to-ClickHouse network path traverses segments accessible to multiple tenants or operators - in such deployments, even a single compromised host on that hop yields full credential and data exposure. Organizations routing this traffic exclusively over isolated, trusted private segments face substantially lower realistic exposure, and the risk profile for pure HTTP-transport ClickHouse deployments is unaffected.

An attacker with access to the network segment between the PDC or SOCKS proxy and the ClickHouse server deploys a passive traffic capture tool or performs ARP spoofing to intercept Native protocol connections. Because the datasource plugin silently skips TLS, the attacker reads ClickHouse authentication credentials, full SQL query text, and query result sets in plaintext without any decryption step. No public exploit code has been identified at time of analysis, but the attack requires only standard network interception tooling and the necessary network adjacency.