Vulnerability in Grafana Clickhouse Datasource
CVE-2026-19854
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- security@grafana.com (vendor-advisory)
Frequently asked questions
- What is CVE-2026-19854?
- CVE-2026-19854 is a medium-severity vulnerability in Grafana Clickhouse Datasource, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.1/10. Published 2026-08-27.
- How severe is CVE-2026-19854?
- Medium severity. CVSS v3 base score is 6.1 out of 10.