# CVE-2026-19854: CVE-2026-19854 CVE Record

> CVE-2026-19854: CVE-2026-19854 CVE Record. CVSS 6.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-19854
Last updated: 2026-08-31T18:50:00Z

- Published: 2026-08-27 16:35 UTC · Updated: 2026-08-31 18:50 UTC · Assigner: GRAFANA
- CVSS: 6.1 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- EPSS: 0.07%, 0th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-319

## Description

When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

## Affected vendors and products

- Grafana: Clickhouse Datasource

## Tracked companies

- [Grafana Cloud](https://rewindex.com/company/grafana-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-19854)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-19854)
- [https://grafana.com/security/security-advisories/cve-2026-19854](https://grafana.com/security/security-advisories/cve-2026-19854)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-19854 · Markdown: https://rewindex.com/cve/CVE-2026-19854.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-19854 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:16:37.758Z