{"id":"CVE-2026-106475","aliases":["EUVD-2026-124574","GHSA-pcjw-cwc9-7g9x","RHSA-2026:95953","RHSA-2026:99114"],"status":"published","title":"Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials","description":"The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00184,"percentile":0.08032,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-863"],"published":"2026-11-12T17:40:38Z","modified":"2026-11-14T13:00:48Z","products":[{"vendor":"grafana","product":"elasticsearch datasource"},{"vendor":"grafana","product":"grafana enterprise"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-106475","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106475","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pcjw-cwc9-7g9x"},{"url":"https://access.redhat.com/errata/RHSA-2026:95953","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-118772","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100105","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-88967","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-88858","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111000","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82014","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106475","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81843","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95953.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88858","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554113","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88967","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563003","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100105","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-100105","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106475","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118772","tags":["advisory"]},{"url":"https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","tags":["article"]},{"url":"https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","tags":["article"]},{"url":"https://github.com/hapijs/joi/pull/3162","tags":["article"]},{"url":"https://github.com/hapijs/joi/pull/3163","tags":["article"]},{"url":"https://github.com/hapijs/joi/releases/tag/v17.13.9","tags":["article"]},{"url":"https://github.com/hapijs/joi/releases/tag/v18.3.1","tags":["article"]},{"url":"https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99114","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-103506","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107365","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99114.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103506","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565163","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107365","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-106475","title":"Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials","description":"The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]","status":"published","published":"2026-11-12T17:40:38.141Z","modified":"2026-11-12T17:40:38.141Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-863","CWE-22"],"updated_at":"2026-11-12T18:46:14.556688Z"}],"euvd":[{"id":"EUVD-2026-124574","description":"The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]","status":"published","published":"2026-11-12T17:40:38Z","modified":"2026-11-12T17:40:38Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-12T20:34:58.221926Z"}],"ghsa":[{"id":"GHSA-pcjw-cwc9-7g9x","title":"The Elasticsearch data source resource proxy forwards the request method and path to...","description":"The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]","status":"published","published":"2026-11-12T18:31:48Z","modified":"2026-11-12T18:31:58Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-12T18:42:37.941061Z"}],"nvd":[{"id":"CVE-2026-106475","description":"The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]","status":"published","published":"2026-11-12T18:17:12.72Z","modified":"2026-11-12T19:09:06.967Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-863"],"updated_at":"2026-11-12T19:32:19.894551Z"}],"osv":[{"id":"RHSA-2026:95953","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"withdrawn","published":"2026-11-13T18:50:06Z","modified":"2026-11-14T13:00:42.198594145Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-14T13:28:49.333691Z"},{"id":"RHSA-2026:99114","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"withdrawn","published":"2026-11-13T18:51:45Z","modified":"2026-11-14T13:00:48.967181829Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-14T13:28:49.333691Z"}]}}