CVE-2026-19854: CVE Record
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the ClickHouse plugin with the Native protocol and either PDC or secure SOCKS are affected. Native is the default protocol.
What access would an attacker need to obtain sensitive data?
An attacker would need to be able to read traffic on the network hop after the proxy. The exposed traffic can include the ClickHouse username, password, queries, and query results.
Does configuring TLS or client certificates protect this connection?
No. Although the plugin requests TLS, the connection library communicates with ClickHouse in cleartext; it does not validate the server certificate or send a configured client certificate.