Skip to content
CVE PROGRAM SOURCE RECORD9.5 Critical

CVE-2026-116366

Unauthenticated RCE vulnerability against ClickHouse Server

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ClickHouse

Description

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ClickHouse ClickHouse

Default version status: affected

  • 26.3 to < 26.3.62.3-ltsaffected
  • 26.8 to < 26.8.36.3-ltsaffected
  • 26.9 to < 26.9.27.3-stableaffected
  • 26.10 to < 26.10.3.7-stableaffected

ClickHouse ClickHouse Cloud

Default version status: unaffected

  • 25.12 to < 25.12.1.1713affected
  • 26.2 to < 26.2.1.835affected
  • 26.4 to < 26.4.1.2704affected
  • 26.6 to < 26.6.1.2439affected
  • 26.8 to < 26.8.1.597affected
  • 26.10 to < 26.10.2.84affected

References