CVE-2026-106475
Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials
CVE-2026-106475 is a high vulnerability (CVSS 7.1) in Grafana Elasticsearch Datasource, published November 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. No source names a fixed version.
- Severity
- 7.1 HighCVSS 3.1, CVE List
- Exploit chance
- 0.18%EPSS, 8th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
What each source reports
CVE List Score used
Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
- Record
CVE-2026-106475- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-863, CWE-22
- Updated
- 2026-11-12
EUVDEUVD-2026-124574
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
- Record
EUVD-2026-124574- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-pcjw-cwc9-7g9x
The Elasticsearch data source resource proxy forwards the request method and path to...
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
- Record
GHSA-pcjw-cwc9-7g9x- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-12
NVD
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
- Record
CVE-2026-106475- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-22, CWE-863
- Updated
- 2026-11-12
OSVRHSA-2026:95953
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:95953- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-14
OSVRHSA-2026:99114
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:99114- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-14
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
grafana.com/security/security-advisories/cve-2026-106475
nvd.nist.gov/vuln/detail/CVE-2026-106475
github.com/advisories/GHSA-pcjw-cwc9-7g9x
access.redhat.com/errata/RHSA-2026:95953
Show 41 moreShow less
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95953.json
bugzilla.redhat.com/show_bug.cgi?id=2554121
cve.org/CVERecord?id=CVE-2026-88858