CriticalPublic exploitVulnerability

CVE-2026-116366

Unauthenticated remote code execution in ClickHouse Server

Published Oct 30, 2026 · Updated 5 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

16 mentions · peak 6 in a dayToday

CVSS9.5Critical · v4

EPSS0.96%62nd percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

IdentifiersCVE-2026-116366CWE-190 · Integer Overflow or Wraparound

CVE-2026-116366 is an integer overflow vulnerability in ClickHouse Server that can allow an unauthenticated attacker with network access to execute arbitrary code under certain conditions. Affected releases include 26.3.x before 26.3.62.3-lts, 26.8.x before 26.8.36.3-lts, 26.9.x before 26.9.27.3-stable, and 26.10.x before 26.10.3.7-stable. The vulnerable function, triggering input, and additional exploitation conditions are not publicly specified in the available information.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can compromise the affected ClickHouse Server, enabling unauthorized data access, data modification, and service disruption. Potential consequences include full system compromise, although the execution privileges and any prerequisites for obtaining elevated operating-system privileges are unspecified. The CVSS v4 assessment assigns high confidentiality, integrity, and availability impacts to both the vulnerable system and subsequent systems.

Mitigation

If you can’t patch tonight, do this now.

Restrict network access to ClickHouse Server to trusted clients using firewall rules, network segmentation, or private connectivity while upgrades are pending. This reduces exposure but does not eliminate exploitation risk from reachable clients. No vulnerability-specific configuration workaround is identified.

Remediation

Patch, then assume compromise.

Upgrade to the fixed release for the installed branch or a later supported release: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, or 26.10.3.7-stable. Fixes were released on October 30, 2026, and all ClickHouse Cloud and BYOC deployments were patched. Separately, affected Debian Linux 12 distribution packages are identified as vendor-unpatched with no known package-specific solution; do not assume those packages include the upstream fixes.

Public exploits

Exploits

1 exploit validated by Mallory's analysis.

View more in app →

CVE-2026-116366The supplied repository contains 38 files, including seven Python programs, one Bash lab manager, one C decoder harness, four XML configurations, seven binary Brotli samples, documentation, and research evidence. It is standalone rather than a framework module. The repository URL is taken from its citation metadata; no analyzed Git reference, archive location, or archive byte size was supplied, so the reference is blank and size_bytes is an unknown-value placeholder of 0. README.md and poc.py are partially truncated in the supplied material. poc.py is the main network entry point. It offers check, detect, dos, and all modes, configurable host/port and credentials, and optional HTTPS with certificate verification disabled. It generates two hardcoded malformed Brotli bodies. The documented delivery is POST /?max_query_size=20000000 with Content-Encoding: br. Raising the query-size limit allows processing past the stream's approximately 16 MiB decompressed prefix. Detection compares a decoder-error response with a timeout on the longer payload; importantly, this detection actively sends the denial-of-service trigger and can leave a vulnerable worker spinning. The parallel dos mode defaults to 32 requests, while the lab wrapper defaults to 48. Timeouts are counted as successful attacks, which is suggestive rather than definitive proof of decoder hangs. Although the help text promises a small DoS demonstration in all mode, the visible main function invokes mode_dos only for dos. The proposed underlying defect is ambiguous failure handling during an illegal Brotli block switch, allowing corrupted decoder state to continue into command processing. Repository logs support persistent CPU-intensive worker exhaustion on ClickHouse 26.10.2.103 and immediate Code: 448 / BROTLI_READ_FAILED rejection on 26.10.3.7. The documentation additionally claims heap out-of-bounds writes and RCE potential, but this repository does not demonstrate controlled corruption or code execution. Its practical implemented capability is remote denial of service. Authentication is performed before body decompression according to the detailed report, contradicting the README's broader pre-authorization wording: passwordless access requires a permissive default-user configuration, which the lab supplies. lab.sh creates vulnerable and patched ClickHouse containers on a dedicated Docker network, each limited to two CPUs and 4 GB RAM, and launches disposable Python or curl clients. It does not publish host ports. scripts/bindiff.py compares normalized ELF function contents, and scripts/fndisasm.py produces symbol-level disassembly differences. src-brotli contains structured mutation and padding fuzzers, a streaming C harness, and candidate triage tooling. Upstream decoder sources and large binaries are intentionally excluded, so these research tools depend on separately prepared builds and hardcoded /work paths. evidence/ contains recorded differential tests, resource measurements, instrumentation output, and fuzz candidates; reports/ contains the root-cause and reproduction narrative. Residual Brotli 1.2.1 hang claims require caution. The supplied harness continues its outer loop on successful decompression and has unusual initial zero-input feeding, creating potential caller-induced nontermination. The triage script compares output growth only after subprocess.run has timed out and terminated its child, so unchanged output cannot establish a live decoder infinite loop. Several shipped hang-named samples also terminated in the included triage log. These artifacts do not independently establish a new patched-library vulnerability. The repository itself says patched ClickHouse rejects these samples, and the supplied fuzz log records no ASAN violations or aborts in 4,000 patched-decoder mutations. Affected-version claims are internally qualified: broad advisory ranges are listed, but the report identifies tested 26.8.34.13 and 26.9.25.15 builds as unaffected because they retain Brotli 1.0.9. No external command-and-control, exfiltration destination, registry modification, or reverse-shell endpoint appears in the supplied code. Public GitHub, advisory, and documentation URLs are references rather than runtime exploit callbacks. These conclusions are based on static review and supplied logs, not independent execution or external validation.googlesky · Disclosed Oct 31, 2026 · python · bash · network · web · fileOperational

External references

References

MITRE CVEcve.org · CVE-2026-116366 NVDnvd.nist.gov/vuln/detail/CVE-2026-116366 MITRE CWE · CWE-190Integer Overflow or Wraparound clickhouse.comclickhouse.com/docs/resources/changelogs/security-changelog github.comgithub.com/ClickHouse/ClickHouse/blob/master/SECURITY.md

Activity feed

Recent activity

17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

runzero blogNews · Nov 2, 2026Critical ClickHouse vulnerability: CVE-2026-116366A critical integer overflow vulnerability in ClickHouse Server, rated CVSS 9.5, could allow unauthenticated remote code execution and potential full system compromise. Affected releases are 26.3.x before 26.3.62.3-lts, 26.8.x before 26.8.36.3-lts, 26.9.x before 26.9.27.3-stable, and 26.10.x before 26.10.3.7-stable. The content recommends upgrading to these fixed versions or later.Read more ↗tenable nessus pluginsNews · Oct 31, 2026Linux Distros Unpatched Vulnerability : CVE-2026-116366 | Tenable®A critical remote code execution vulnerability in ClickHouse Server that could allow an unauthenticated, network-accessible attacker to execute arbitrary code under certain conditions. The advisory lists CVSS v3 severity as 9.8 and CVSS v4 severity as 9.5. Affected packages lack a vendor-supplied patch, and no known solution is provided. Nessus detects affected package presence rather than verifying exploitation.Read more ↗ghsa syntheticNews · Oct 30, 2026GHSA-qhgw-ghp3-xh36An unauthenticated remote code execution vulnerability in ClickHouse Server. Under unspecified conditions, an attacker with network access could execute arbitrary code on the server. The advisory does not identify affected versions or provide exploitation or remediation details.Read more ↗cvefeed high severityNews · Oct 30, 2026CVE-2026-116366 - Unauthenticated RCE vulnerability against ClickHouse ServerAn unauthenticated remote code execution vulnerability in ClickHouse Server, classified as CWE-190 (integer overflow or wraparound). The supplied CVSS v4.0 vector indicates network-based exploitation with high attack complexity, no required privileges or user interaction, and potentially high confidentiality, integrity, and availability impacts to both the vulnerable and subsequent systems. The record reports its initial receipt on October 30, 2026, but provides no affected versions or remediation details.Read more ↗

+1 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity12Community discussion across Reddit, Mastodon, and other social sources.