---
id: "CVE-2026-106475"
page: "https://infrastack.ai/live/CVE-2026-106475"
kind: "vulnerability"
aliases: ["CVE-2026-106475"]
title: "Grafana: Elasticsearch data source proxy lets queriers reach other indices"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "grafana", "fixed": ["12.4.15"], "affected": "< 12.4.15 (12.4 line; other branches unconfirmed)", "ecosystem": "vendor"}, {"via": "cpe", "name": "github.com/grafana/grafana", "fixed": ["12.4.15"], "affected": "< 12.4.15 (12.4 line; other branches unconfirmed)", "ecosystem": "go"}]
ecosystems: ["go", "vendor"]
tags: ["elasticsearch", "grafana", "package", "self-hosted"]
not_affected_if: ["no-elasticsearch-data-source", "read-only-scoped-credentials"]
published_at: "2026-11-12T18:17:12+00:00"
first_seen_at: "2026-11-12T18:40:37+00:00"
updated_at: "2026-11-12T19:12:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106475", "first_seen_at": "2026-11-12T18:40:37+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106475", "first_seen_at": "2026-11-12T18:43:46+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-106475", "https://github.com/grafana/grafana/blob/main/CHANGELOG.md"]}]
exploit_sources: []
---

# Grafana: Elasticsearch data source proxy lets queriers reach other indices

Link for people: https://infrastack.ai/live/CVE-2026-106475 (this .md is for agents)

The Grafana Elasticsearch data source resource proxy forwards any request method and path to Elasticsearch using the data source's stored credentials. A user who can run queries against that data source can change index mappings or read other indices on the cluster.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:grafana affected < 12.4.15 (12.4 line; other branches unconfirmed) fixed 12.4.15
- go:github.com/grafana/grafana affected < 12.4.15 (12.4 line; other branches unconfirmed) fixed 12.4.15

## How to check

- Run 'grafana-server -v' or read the UI footer. On the 12.4 line, versions below 12.4.15 are listed as vulnerable by the third-party changelogs.us; Grafana's changelog only confirms the fix in 12.4.15.
- List Elasticsearch data sources (Connections > Data sources). For each, check whether the stored credentials can reach other indices or change mappings. Scope them to read-only on the needed indices.
- Check who has Viewer/Editor access or query permission on those data sources.

## Fix

Upgrade Grafana 12.4.x to 12.4.15 (Grafana changelog). Fixed versions on other branches are not confirmed in the sources; check the changelog for your branch. Until then, give the Elasticsearch data source credentials read-only access limited to the indices Grafana needs.

## Timeline

- 2026-11-12T18:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106475
- 2026-11-12T18:43:46+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-106475 — Grafana's own CHANGELOG lists 'Security: Fix CVE-2026-106475' in 12.4.15 (2026-11-10). Other branches (13.x, 12.3 and earlier) and the exact affected start version not confirmed; grafana.com advisory page not found for this CVE. Technical detail from NVD description only.

## Documents

- [describes] NVD CVE-2026-106475 https://nvd.nist.gov/vuln/detail/CVE-2026-106475
- [fix] Grafana CHANGELOG (12.4.15, 2026-11-10: Security: Fix CVE-2026-106475) https://github.com/grafana/grafana/blob/main/CHANGELOG.md

## From the sources

The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_