Grafana: Elasticsearch data source resource proxy improper authorization (CVE-2026-106475)
Grafana's Elasticsearch data source resource proxy incorrectly forwards request methods and paths using plugin credentials, potentially allowing unauthorized access to index mappings or restricted indices.
CVE search metadata
CVE search record: CVE-2026-106475. Severity: high. CVSS: 7.1. KEV: no. Product: Grafana. Brief: Grafana: Elasticsearch data source resource proxy improper authorization (CVE-2026-106475). Brief link: https://feed.craftedsignal.io/briefs/2026-11-grafana-elasticsearch-proxy-cve-2026-106475/
Triage facts
Revision 1- Applicability
- Grafana
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Elasticsearch data source resource proxy in Grafana fails to restrict request methods and paths forwarded to the backend Elasticsearch cluster. It uses the data source's own credentials to perform these operations, allowing an authenticated user who can query the data source to potentially alter index mappings or reach other indices on the cluster.
Impact
Successful exploitation allows an authenticated user to perform unauthorized actions against the backend Elasticsearch cluster, such as altering index mappings or accessing indices that should be restricted based on the plugin's service credentials.
Recommendation
Review the vendor security advisories for patch availability and apply the relevant security updates to your Grafana installation.