CVE-2026-19854

Awaiting Analysis Awaiting Analysis - Queue

ClickHouse Plugin TLS Bypass via Native Protocol

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: Grafana Labs

Description

When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-19854

EUVD

EUVD-2026-67089

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	clickhouse_plugin	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Executive Summary

The ClickHouse plugin with Native protocol (default) using PDC or secure SOCKS requests TLS but the connection library ignores this and communicates with ClickHouse without encryption. This exposes usernames, passwords, queries, and results to interception on the network path. The server certificate is never verified and a configured client certificate is not transmitted.

Detection Guidance

Check if the ClickHouse plugin is using Native protocol with PDC or secure SOCKS. Monitor network traffic for unencrypted connections to ClickHouse despite TLS requests. Use packet capture tools like tcpdump or Wireshark to inspect traffic for plaintext credentials or queries.

Impact Analysis

An attacker on the network between the client and proxy could read sensitive data like credentials, database queries, and results. This could lead to unauthorized access to data, data theft, or manipulation of queries without detection.

Compliance Impact

This vulnerability likely violates requirements for encryption of data in transit under GDPR and HIPAA. It exposes personal or health data to unauthorized parties, risking non-compliance with data protection and privacy regulations.

Mitigation Strategies

Disable Native protocol for the ClickHouse plugin if possible. Ensure TLS is enforced and certificates are properly validated. Avoid using PDC or secure SOCKS with the plugin. Update the plugin to a patched version if available.

Hi! I’m here to help you understand CVE-2026-19854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70