Critical ClickHouse Flaw Allows Unauthenticated Remote Code Execution
Vulnerability Disclosure · 5 sources · Updated 8d ago · First seen Oct 30, 2026
ClickHouse disclosed CVE-2026-116366, a critical vulnerability that could allow an unauthenticated attacker with network access to execute arbitrary code on ClickHouse Server under certain conditions. The vulnerability carries a CNA-assigned CVSS score of 9.5. The supplied disclosures do not specify the conditions required for exploitation, so the score should not be interpreted as evidence that every deployment is exploitable.
Fixes were released on October 30, 2026, and applied to all ClickHouse Cloud and BYOC deployments, according to the vendor’s security changelog. Listed fixed versions include 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable, and 25.12.1.1713, with additional releases available. Self-managed operators should consult the vendor changelog, upgrade to an appropriate fixed release, and restrict unnecessary network access. At publication, the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalog, and the tracking reference reported no public exploit on Exploit-DB, Metasploit, or GitHub; neither finding rules out exploitation.
