Bug 2525068 (CVE-2026-19854)

Summary: CVE-2026-19854 grafana: Grafana ClickHouse Plugin: Information disclosure via cleartext communication
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Grafana ClickHouse plugin. When using the Native protocol with PDC or secure SOCKS, the connection library fails to enforce Transport Layer Security (TLS), causing sensitive data such as usernames, passwords, queries, and results to be transmitted in cleartext. This allows a network attacker to intercept and read this information. Additionally, the server certificate is not validated, and client certificates are not sent, further compromising the security of the connection.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-27 16:57:02 UTC 
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.