{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-106475/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:grafana_labs:grafana:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-106475"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grafana"],"_cs_severities":["high"],"_cs_tags":["cve-2026-106475","grafana"],"_cs_type":"advisory","_cs_vendors":["Grafana Labs"],"content_html":"\u003cp\u003eThe Elasticsearch data source resource proxy in Grafana fails to restrict request methods and paths forwarded to the backend Elasticsearch cluster. It uses the data source's own credentials to perform these operations, allowing an authenticated user who can query the data source to potentially alter index mappings or reach other indices on the cluster.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform unauthorized actions against the backend Elasticsearch cluster, such as altering index mappings or accessing indices that should be restricted based on the plugin's service credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eReview the vendor security advisories for patch availability and apply the relevant security updates to your Grafana installation.\u003c/p\u003e\n","date_modified":"2026-11-12T18:50:43Z","date_published":"2026-11-12T18:50:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-grafana-elasticsearch-proxy-cve-2026-106475/","summary":"Grafana's Elasticsearch data source resource proxy incorrectly forwards request methods and paths using plugin credentials, potentially allowing unauthorized access to index mappings or restricted indices.","title":"Grafana: Elasticsearch data source resource proxy improper authorization (CVE-2026-106475)","url":"https://feed.craftedsignal.io/briefs/2026-11-grafana-elasticsearch-proxy-cve-2026-106475/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-106475","version":"https://jsonfeed.org/version/1.1"}