CVE-2026-116366 Unauthenticated RCE vulnerability against ClickHouse Server
CriticalCVSS 9.5
EPSS 0.96%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ClickHouse | >= 26.3, < 26.3.62.3-lts | 26.3.62.3-lts |
| ClickHouse | >= 26.8, < 26.8.36.3-lts | 26.8.36.3-lts |
| ClickHouse | >= 26.9, < 26.9.27.3-stable | 26.9.27.3-stable |
| ClickHouse | >= 26.10, < 26.10.3.7-stable | 26.10.3.7-stable |
| ClickHouse Cloud | >= 25.12, < 25.12.1.1713 | 25.12.1.1713 |
| ClickHouse Cloud | >= 26.2, < 26.2.1.835 | 26.2.1.835 |
| ClickHouse Cloud | >= 26.4, < 26.4.1.2704 | 26.4.1.2704 |
| ClickHouse Cloud | >= 26.6, < 26.6.1.2439 | 26.6.1.2439 |
| ClickHouse Cloud | >= 26.8, < 26.8.1.597 | 26.8.1.597 |
| ClickHouse Cloud | >= 26.10, < 26.10.2.84 | 26.10.2.84 |
| debian/clickhouse(Debian:12) | All versions | No fix listed |
| debian/clickhouse(Debian:12) | = 18.16.1+ds-7.3 | No fix listed |
| debian/clickhouse(Debian:12) | = 18.16.1+ds-7.4 | No fix listed |
| ubuntu/clickhouse(Ubuntu:24.04) | All versions | No fix listed |
References
- github.com
- clickhouse.com
- Debian Security Tracker CVE-2026-116366 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org