CVE-2026-106475
Description
A flaw was found in Grafana's Elasticsearch data source. An authenticated user with permission to query the data source, such as a viewer, can send arbitrary requests to the connected Elasticsearch cluster using the data source's stored credentials. This allows an attacker to bypass intended restrictions, access data across unauthorized indices, and execute write operations to modify index configurations or data.
Statement
Red Hat has rated this vulnerability as an Important severity flaw because low-privileged authenticated users, including those with Viewer permissions, can use configured Elasticsearch data sources to dispatch arbitrary requests to the backend cluster using the data source credentials. This exposure can allow attackers to perform write operations, modify index mappings, or access data in indices beyond what the data source was intended to query. The risk is constrained to Grafana deployments where an Elasticsearch data source has been established and requires valid user credentials to interact with the service.
Mitigation
Restrict the permissions granted to the credentials used by Grafana to connect to Elasticsearch:
1. Configure Elasticsearch role-based access control to assign the data source account a strictly read-only role constrained to the specific indices required for monitoring.
2. Ensure that write privileges, index creation or management permissions, and cluster-level administrative rights are removed from the configured data source credentials.
Caveats:
Applying strict read-only access may disrupt workflows if existing dashboards or integrations expect the data source to write data or query unassigned indices. Grafana does not require a service restart for modified Elasticsearch role permissions to take effect, but changes apply immediately on the Elasticsearch backend.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 7.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | Low |
| Availability Impact | Low | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
