CVE-2026-19854

A flaw was found in the Grafana ClickHouse plugin. When using the Native protocol with PDC or secure SOCKS, the connection library fails to enforce Transport Layer Security TLS, causing sensitive data such as usernames, passwords, queries, and results to be transmitted in cleartext. This allows a...

CVE-2026-19854: Cleartext Transmission of Sensitive Information

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...