When the Grafana ClickHouse datasource plugin is configured to use its default Native protocol together with PDC or secure SOCKS proxy settings, the plugin mistakenly requests TLS but proceeds to open a plaintext channel to the ClickHouse server. This defect allows every username, password, SQL query, and result that passes through the proxy to be read by anyone who can observe the traffic after the proxy hop. Additionally the server certificate is never validated and no client certificate is transmitted, further weakening the trust boundary. The flaw undermines confidentiality but does not provide any code‑execution capability.

The vulnerability applies to Grafana installations that use the ClickHouse datasource plugin when the Native protocol is chosen automatically (the default) in combination with PDC or secure SOCKS proxies. No specific product version information is listed, so the problem likely affects all releases that retain this default behavior.

With a CVSS score of 6.1 the issue is classified as moderate. EPSS data is unavailable and the flaw is not yet in the CISA KEV catalog. Attacking this weakness requires an attacker to position themselves after the proxy, which often implies internal network access or a compromised proxy. Once positioned, the attacker can freely capture credentials and query data, a valuable payload for many adversaries. The lack of certificate validation and the omission of client certificates widen the exposure window, making plain‑text eavesdropping straightforward.