Description

When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-27T17:17:43.030Z",
  "pubdate": "2026-08-27T17:17:43.030Z",
  "executiveSummary": "The ClickHouse plugin is affected by a critical security flaw involving the insecure handling of Native protocol connections when utilizing PDC or secure SOCKS proxies. Despite explicit configuration requesting TLS encryption, the underlying connection library fails to initiate a secure handshake, resulting in the transmission of data in plaintext.\nThis vulnerability exposes sensitive information, including usernames, passwords, database queries, and query result sets, to unauthorized interception by malicious actors positioned on the network path between the client and the proxy.\nThe vulnerability also encompasses a complete absence of server certificate validation and the failure to present client certificates, effectively nullifying mutual TLS (mTLS) authentication mechanisms. Any attacker with the capability to perform man-in-the-middle (MITM) operations on the hop following the proxy can successfully sniff traffic, impersonate the server, or intercept authentication credentials. The risk is high, as the failure occurs silently, leaving users with a false sense of security regarding the encryption of their data-in-transit.",
  "technicalDetails": "The root cause of this vulnerability lies in a protocol implementation failure within the ClickHouse plugin's connection handling logic when operating via PDC or secure SOCKS proxies. Although the plugin is configured to enforce TLS-encrypted Native protocol communication, the integration with the underlying connection library results in an ignored TLS request. Consequently, the library defaults to an unencrypted communication channel, completely bypassing the TLS stack.\nThe attack flow begins when a client attempts to connect to a ClickHouse instance through a configured proxy. The plugin initiates the request, but due to the flawed implementation, the connection is established in cleartext. Because the library fails to perform server certificate verification, the client is unable to verify the identity of the remote endpoint. An attacker positioned on the network segment between the proxy and the ClickHouse server can perform a man-in-the-middle attack to intercept the cleartext traffic.\nThe impact of this interception is significant: since the Native protocol transmits credentials and query data without encryption, the attacker can extract plaintext authentication credentials (usernames and passwords). Furthermore, all subsequent database interactions, including administrative commands and sensitive data retrieval (SELECT results), are fully exposed to the attacker.\nAdditionally, because the connection library does not transmit configured client certificates, any security architecture relying on mTLS for authentication is rendered ineffective. The server-side verification of the client identity fails or never occurs, bypassing access controls that rely on valid certificate presentation. This condition persists regardless of the user's intent to secure the connection, as the logic flow defaults to the insecure state without warning. The vulnerability does not require complex exploitation techniques; it is inherent to the transport layer implementation of the plugin, making it trivial for an attacker with network visibility to gain full insight into the data stream, potentially leading to unauthorized data access, credential theft, and full compromise of the database session."
}