Improper Authorization in Elasticsearch Data Source by Grafana
CVE-2026-106475

7.1HIGH

Key Information:

Vendor

Grafana
Status
Elastic Datasource
Grafana Oss
Grafana Enterprise
Vendor
CVE Published:
12 November 2026

What is CVE-2026-106475?

The Elasticsearch data source plugin for Grafana suffers from an improper authorization vulnerability that allows a user to use the data source's credentials to make unverified requests to the Elasticsearch backend. This flaw enables unauthorized users to modify index mappings or access sensitive indices, potentially compromising the integrity and confidentiality of the data stored within the cluster. Proper safeguards should be in place to restrict access to necessary operations and protect against unauthorized data exposure.

Affected Version(s)

Elasticsearch Datasource 12.4.2 < 12.9.6

Grafana Enterprise 10.1.0 <= 11.6.16

Grafana Enterprise 12.0.0 <= 12.2.10

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.