Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-116366: ClickHouse Server permits remote code execution
CVE-2026-116366 · published 2 days ago
Summary
An unauthenticated user on the network can run any code on ClickHouse Server, including the cloud version hosted on Debian. This could let attackers take control of the database server and its data. Install the latest security updates for ClickHouse and ensure your systems are running the patched versions.
What to do
- Update clickhouse clickhouse to version 26.3.62.3-lts or later.
- Update clickhouse clickhouse cloud to version 25.12.1.1713 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | clickhouse | clickhouse | < 26.3.62.3-lts |
| – | clickhouse | clickhouse cloud | < 25.12.1.1713 |
| Debian:12 | debian | clickhouse | All versions |
Original advisory text
DEBIAN-CVE-2026-116366
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-190Integer Overflow
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen30 Oct 2026
Track software like this
Free during beta