CVE-2026-19854
CVE-2026-19854 CVE Record
- State
- Published
- Severity
- 6.1 Medium
- Published
- Aug 27, 2026
- Updated
- Aug 27, 2026
- Reserved
- Aug 14, 2026
Description
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N | GRAFANA |
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
Clickhouse DatasourceGrafana |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.