{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106475", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-10-06T17:52:05.181Z", "datePublished": "2026-11-12T17:40:38.141Z", "dateUpdated": "2026-11-12T17:40:38.141Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Elasticsearch Datasource", "vendor": "Grafana", "versions": [{"lessThan": "12.9.6", "status": "affected", "version": "12.4.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "10.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "10.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}]}], "datePublic": "2026-11-10T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]"}], "metrics": [{"cvssV3_1": {"baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "description": "CWE-22", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-11-12T17:40:38.141Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-106475"}], "source": {"discovery": "INTERNAL_FINDING"}, "title": "Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials"}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Elasticsearch Datasource", "vendor": "Grafana", "versions": [{"lessThan": "12.9.6", "status": "affected", "version": "12.4.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "10.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.16", "status": "affected", "version": "10.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.10", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.15", "status": "affected", "version": "12.4.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]"}], "id": "CVE-2026-106475", "lastModified": "2026-11-12T19:09:06.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "security@grafana.com", "type": "Secondary"}]}, "published": "2026-11-12T18:17:12.720", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-106475"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-863"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: ELASTICSEARCH DATA SOURCE COULD BE USED TO SEND ARBITRARY REQUESTS TO ELASTICSEARCH", "id": "2565159", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565159"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-267", "details": ["A flaw was found in Grafana's Elasticsearch data source. An authenticated user with permission to query the data source, such as a viewer, can send arbitrary requests to the connected Elasticsearch cluster using the data source's stored credentials. This allows an attacker to bypass intended restrictions, access data across unauthorized indices, and execute write operations to modify index configurations or data."], "mitigation": {"lang": "en:us", "value": "Restrict the permissions granted to the credentials used by Grafana to connect to Elasticsearch:\n1. Configure Elasticsearch role-based access control to assign the data source account a strictly read-only role constrained to the specific indices required for monitoring.\n2. Ensure that write privileges, index creation or management permissions, and cluster-level administrative rights are removed from the configured data source credentials.\nCaveats:\nApplying strict read-only access may disrupt workflows if existing dashboards or integrations expect the data source to write data or query unassigned indices. Grafana does not require a service restart for modified Elasticsearch role permissions to take effect, but changes apply immediately on the Elasticsearch backend."}, "name": "CVE-2026-106475", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106475\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106475"], "statement": "Red Hat has rated this vulnerability as an Important severity flaw because low-privileged authenticated users, including those with Viewer permissions, can use configured Elasticsearch data sources to dispatch arbitrary requests to the backend cluster using the data source credentials. This exposure can allow attackers to perform write operations, modify index mappings, or access data in indices beyond what the data source was intended to query. The risk is constrained to Grafana deployments where an Elasticsearch data source has been established and requires valid user credentials to interact with the service.", "threat_severity": "Important"}