UpHeron
All vulnerabilities

Servers and applications

CVE-2026-106475

Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials

Severity
High 7.1
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
12.4.15
Weakness
Incorrect authorization (CWE-863)Path traversal (CWE-22)
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Sources
CVE Program

Description

The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • From 10.1.0 up to 11.6.16
  • From 12.0.0 up to 12.2.10
  • From 12.3.0 up to 12.3.11
  • From 12.4.0 before 12.4.15

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-106475