CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:NCVE-2026-106475 Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials
High (7.1) in grafana. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.
On this page
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
Severity
- EPSS
- 0.2% estimated probability of exploitation activity in the next 30 days; 8th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CWEs
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path traversal)
CWE-863 Incorrect Authorization - OWASP Top 10
- A01:2025 Broken Access Control
- Published
- Modified
- Assigned by
- GRAFANA (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-106475 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-106475?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-106475?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-106475 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-106475)
HTML:
<a href="https://cve.bz/cve/CVE-2026-106475"><img src="https://cve.bz/cve/badge/CVE-2026-106475.svg" alt="CVE-2026-106475"></a>
Affected
- grafana:elasticsearch datasource
- grafana:grafana enterprise
- grafana:grafana oss
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| Grafana Elasticsearch Datasource | from 12.4.2 before 12.9.6 |
| Grafana OSS | from 10.1.0 through 11.6.16 |
| Grafana OSS | from 12.0.0 through 12.2.10 |
| Grafana OSS | from 12.3.0 through 12.3.11 |
| Grafana OSS | from 12.4.0 before 12.4.15 |
| Grafana Enterprise | from 10.1.0 through 11.6.16 |
| Grafana Enterprise | from 12.0.0 through 12.2.10 |
| Grafana Enterprise | from 12.3.0 through 12.3.11 |
| Grafana Enterprise | from 12.4.0 before 12.4.15 |
Fix and patched versions
- Red Hat: fixed package versions per release
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Red Hat | hummingbird:1 | grafana13.1 | 0:13.1.9-0.1.hum1 | RHSA-2026:95953 |
| Red Hat | hummingbird:1 | grafana13.2 | 0:13.2.5-0.1.hum1 | RHSA-2026:99114 |
From the distributions' data via OSV.dev: Red Hat Security Data © Red Hat, Inc., CC BY 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Red Hat.
Red Hat
Red Hat rates this Important.
Red Hat has rated this vulnerability as an Important severity flaw because low-privileged authenticated users, including those with Viewer permissions, can use configured Elasticsearch data sources to dispatch arbitrary requests to the backend cluster using the data source credentials. This exposure can allow attackers to perform write operations, modify index mappings, or access data in indices beyond what the data source was intended to query. The risk is constrained to Grafana deployments where an Elasticsearch data source has been established and requires valid user credentials to interact with the service.
Restrict the permissions granted to the credentials used by Grafana to connect to Elasticsearch:
1. Configure Elasticsearch role-based access control to assign the data source account a strictly read-only role constrained to the specific indices required for monitoring.
2. Ensure that write privileges, index creation or management permissions, and cluster-level administrative rights are removed from the configured data source credentials.
Caveats:
Applying strict read-only access may disrupt workflows if existing dashboards or integrations expect the data source to write data or query unassigned indices. Grafana does not require a service restart for modified Elasticsearch role permissions to take effect, but changes apply immediately on the Elasticsearch backend.
| Product | Package | State | Advisory |
|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Affected | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Affected | |
| Red Hat Ceph Storage 7 | rhceph/grafana-rhel9 | Fix deferred | |
| Red Hat Ceph Storage 8 | rhceph/grafana-rhel9 | Fix deferred | |
| Red Hat Ceph Storage 9 | rhceph/grafana-rhel10 | Fix deferred | |
| Red Hat Enterprise Linux 10 | grafana | Affected | |
| Red Hat Enterprise Linux 8 | grafana | Affected | |
| Red Hat Enterprise Linux 9 | grafana | Affected | |
| Red Hat Hardened Images | grafana12.4 | Affected | |
| Red Hat Hardened Images | grafana13.1 | Affected | |
| Red Hat Hardened Images | grafana13.2 | Affected | |
| Red Hat Hardened Images | hi/grafana | Not affected |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-106475.
Attack patterns (CAPEC)
- CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
- CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
- CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
- CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
- CAPEC-126 Path Traversal Likelihood: High · Severity: Very High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.