CVE-2026-19854: CWE-319:Cleartext Transmission of Sensitive Information in Grafana Clickhouse Datasource

The Grafana Clickhouse Datasource plugin version 3.1.0 has a vulnerability (CVE-2026-19854) involving cleartext transmission of sensitive data. When the plugin uses the Native protocol with PDC or secure SOCKS proxies, it requests TLS but the connection library does not enforce it, causing communication with ClickHouse to occur without encryption. Sensitive information including authentication credentials and query data can be intercepted after the proxy. The implementation also fails to verify the server certificate and does not send the configured client certificate, weakening the security of the connection.

An attacker positioned on the network path after the proxy could intercept sensitive information such as usernames, passwords, queries, and query results due to the lack of encryption and certificate verification. This compromises confidentiality but does not affect integrity or availability. The CVSS score of 6.1 reflects a medium severity with high impact on confidentiality and limited attack vector (adjacent network).

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is provided, avoid using the Native protocol with PDC or secure SOCKS proxies in environments where network interception is possible, or consider alternative secure configurations if available.