Clickhouse Datasource
Monthly
TLS bypass in Grafana's ClickHouse Datasource plugin (versions 3.1.0 through 4.20.0) silently transmits database traffic in cleartext when the Native protocol is routed through a PDC or secure SOCKS proxy, despite TLS being configured. The underlying connection library ignores the TLS request without raising an error, exposing ClickHouse usernames, passwords, SQL queries, and query results to any attacker positioned on the network hop between the proxy and the database server. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
TLS bypass in Grafana's ClickHouse Datasource plugin (versions 3.1.0 through 4.20.0) silently transmits database traffic in cleartext when the Native protocol is routed through a PDC or secure SOCKS proxy, despite TLS being configured. The underlying connection library ignores the TLS request without raising an error, exposing ClickHouse usernames, passwords, SQL queries, and query results to any attacker positioned on the network hop between the proxy and the database server. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.