CVE-2026-19854
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.
Risk Assessment
Sensitive credentials and query content can be intercepted by an attacker on the network, leading to confidentiality and integrity breaches.
Recommendation
Update the ClickHouse plugin to a version that properly enforces TLS and ensure certificate verification is enabled.
Original NVD description (English source)
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.