CVE-2026-116366: Unauthenticated RCE vulnerability against ClickHouse Server

Severity: critical (CVSS 9.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-30 · updated 2026-10-30
Weakness: CWE-190

Description

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Summary

ClickHouse Server contains an unauthenticated remote code execution flaw that, under certain conditions, lets an attacker with network access run arbitrary code on the server. With a CVSS score of 9.5 (critical), successful exploitation could lead to full compromise of the ClickHouse host. The issue is not listed in CISA KEV, so no known active exploitation has been confirmed. Affected deployments should upgrade to 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, or 26.10.3.7-stable; until patched, restrict network access to ClickHouse Server.

تحتوي ClickHouse Server على ثغرة تنفيذ تعليمات برمجية عن بُعد دون مصادقة، تتيح في ظروف معينة لمهاجم لديه وصول إلى الشبكة تنفيذ تعليمات برمجية عشوائية على الخادم. وبدرجة خطورة 9.5 (حرجة)، قد يؤدي الاستغلال الناجح إلى اختراق كامل لمضيف ClickHouse. الثغرة غير مدرجة في CISA KEV، لذا لم يُؤكَّد أي استغلال نشط معروف. يجب على عمليات النشر المتأثرة الترقية إلى 26.3.62.3-lts أو 26.8.36.3-lts أو 26.9.27.3-stable أو 26.10.3.7-stable، وإلى حين تطبيق التصحيح يُنصح بتقييد الوصول الشبكي إلى ClickHouse Server.

Affected products

ClickHouse: from 26.3 before 26.3.62.3-lts; from 26.8 before 26.8.36.3-lts; from 26.9 before 26.9.27.3-stable; from 26.10 before 26.10.3.7-stable — fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable
Clickhouse Cloud: from 25.12 before 25.12.1.1713; from 26.2 before 26.2.1.835; from 26.4 before 26.4.1.2704; from 26.6 before 26.6.1.2439; from 26.8 before 26.8.1.597; from 26.10 before 26.10.2.84 — fixed in 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597, 26.10.2.84

How to fix

Upgrade to a fixed version: ClickHouse 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable; Clickhouse Cloud 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-116366 or the next vulnerability affects your stack