CVE-2026-19854

medium Grafana
CVSS v3 Base Score
6.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score
0.1%
Exploitation probability in 30 days
Top 100% most likely to be exploited
Attack Characteristics
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Confidentiality
High
Integrity
None
Availability
None
Published: August 27, 2026 (10 days ago)
Last Modified: August 31, 2026
Vendor: Grafana
Source: NVD

Description

When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

CWE

CWE-319

References

🔗 grafana.com