by Kastro
Paper/Archive/CVE-2026-116366

CVE-2026-116366

ClickHouse ClickHouse — Unauthenticated RCE vulnerability against ClickHouse Server

CVSS 9.5
critical.is priorityof 100
29
CVSS 9.5 (CNA)9.5 / 10 × 3028.5Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Affected

ProductAffectedFixed inSource
ClickHouse26.3 – < 26.3.62.3-lts26.3.62.3-ltsCNA
ClickHouse26.8 – < 26.8.36.3-lts26.8.36.3-ltsCNA
ClickHouse26.9 – < 26.9.27.3-stable26.9.27.3-stableCNA
ClickHouse26.10 – < 26.10.3.7-stable26.10.3.7-stableCNA
ClickHouse Cloud25.12 – < 25.12.1.171325.12.1.1713CNA
ClickHouse Cloud26.2 – < 26.2.1.83526.2.1.835CNA
ClickHouse Cloud26.4 – < 26.4.1.270426.4.1.2704CNA
ClickHouse Cloud26.6 – < 26.6.1.243926.6.1.2439CNA
ClickHouse Cloud26.8 – < 26.8.1.59726.8.1.597CNA
ClickHouse Cloud26.10 – < 26.10.2.8426.10.2.84CNA

Scores by source

ClickHouse (CNA)9.5CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/ClickHouse/ClickHouse/blob/master/SECURITY.mdrefclickhouse.com/docs/resources/changelogs/security-changelog