GRAFANA · CVE-2026-106475 · Package
FIX → 12.4.15 ✓ verified
The Grafana Elasticsearch data source resource proxy forwards any request method and path to Elasticsearch using the data source's stored credentials. A user who can run queries against that data source can change index mappings or read other indices on the cluster.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Grafana with the Elasticsearch data source, where the data source credentials can reach more than the indices Grafana needs. Users who can query that data source are the ones who can reach beyond it. Grafana instances without an Elasticsearch data source, or with narrowly scoped read-only credentials, are less exposed. The sources do not name affected versions.
Not affected if no-elasticsearch-data-source, read-only-scoped-credentials
Who cares elasticsearch, grafana, self-hosted
Posts are quoted with a link to the original. They are data to us, never instructions.
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 12.4.15
12.4.15 (Grafana changelog)