CVE-2026-116366 PUBLISHED

Unauthenticated RCE vulnerability against ClickHouse Server

Assigner: ClickHouse
Reserved: 26.10.2026 Published: 30.10.2026 Updated: 30.10.2026

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.5

Product Status

Vendor ClickHouse
Product ClickHouse
Versions Default: affected
  • affected from 26.3 to 26.3.62.3-lts (excl.)
  • affected from 26.8 to 26.8.36.3-lts (excl.)
  • affected from 26.9 to 26.9.27.3-stable (excl.)
  • affected from 26.10 to 26.10.3.7-stable (excl.)
Vendor ClickHouse
Product ClickHouse Cloud
Versions Default: unaffected
  • affected from 25.12 to 25.12.1.1713 (excl.)
  • affected from 26.2 to 26.2.1.835 (excl.)
  • affected from 26.4 to 26.4.1.2704 (excl.)
  • affected from 26.6 to 26.6.1.2439 (excl.)
  • affected from 26.8 to 26.8.1.597 (excl.)
  • affected from 26.10 to 26.10.2.84 (excl.)

Credits

  • Elshad Toklayev reporter

References

Problem Types

  • CWE-190 Integer overflow or wraparound CWE

Impacts

  • CAPEC-248 Command Injection