Live › vulnerability › CVE-2026-116366
ClickHouse Server has a flaw that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server. The sources do not name the affected versions or the exact trigger.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 11:29 UTC. All times on this page are UTC.
ClickHouse Server instances reachable over the network are the concern, especially those exposed beyond a trusted network. The sources do not describe the exact configuration that triggers the flaw. Teams that run ClickHouse only on isolated, non-network-facing hosts are less exposed.
No product ranges from the sources yet.
clickhouse-server --version (or SELECT version())Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
This page as .md · .json · in your agent: get_signal("CVE-2026-116366")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.