Cve-2026-106475 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-106475/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 18:50:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGrafana: Elasticsearch data source resource proxy improper authorization (CVE-2026-106475)https://feed.craftedsignal.io/briefs/2026-11-grafana-elasticsearch-proxy-cve-2026-106475/Thu, 12 Nov 2026 18:50:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-grafana-elasticsearch-proxy-cve-2026-106475/Grafana's Elasticsearch data source resource proxy incorrectly forwards request methods and paths using plugin credentials, potentially allowing unauthorized access to index mappings or restricted indices.The Elasticsearch data source resource proxy in Grafana fails to restrict request methods and paths forwarded to the backend Elasticsearch cluster. It uses the data source's own credentials to perform these operations, allowing an authenticated user who can query the data source to potentially alter index mappings or reach other indices on the cluster.

Impact

Successful exploitation allows an authenticated user to perform unauthorized actions against the backend Elasticsearch cluster, such as altering index mappings or accessing indices that should be restricted based on the plugin's service credentials.

Recommendation

Review the vendor security advisories for patch availability and apply the relevant security updates to your Grafana installation.

]]>highadvisorycve-2026-106475grafana