Executive brief
The Grafana ClickHouse datasource plugin fails to enforce TLS encryption when connecting through a PDC or secure SOCKS proxy, despite requesting it. Attackers positioned on the network hop after the proxy can intercept database credentials, queries, and results transmitted in plaintext, compromising the confidentiality of sensitive data flowing through the ClickHouse database connection.
Technical details
This is a TLS/encryption bypass vulnerability in the ClickHouse datasource plugin for Grafana. The plugin's connection library, when configured to use the Native protocol (the default) with PDC or secure SOCKS proxies, requests TLS but the underlying library silently ignores that directive and establishes unencrypted connections. Additionally, server certificate validation is not performed and configured client certificates are not sent. An attacker with network access to the hop after the proxy (e.g., on the same network segment) can passively intercept traffic to read usernames, passwords, database queries, and query results. The vulnerability is fixed in ClickHouse Datasource version 4.21.1 and later.
Affected products
- Grafana ClickHouse Datasource <4.21.1
Timeline
- 2026-08-27: disclosed