{"id":"CVE-2026-116366","kind":"vulnerability","aliases":["CVE-2026-116366"],"related":[],"title":"ClickHouse Server: unauthenticated network user can run arbitrary code","description":"An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.","summary":"ClickHouse Server has a flaw that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server. The sources do not name the affected versions or the exact trigger.","severity":"critical","cvss":9.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clickhouse","databases","runtime","self-hosted"],"not_affected_if":["no-network-exposure"],"how_to_check":"Run 'clickhouse-server --version' (or SELECT version()). Check whether ports 9000 (native), 8123 (HTTP) and 9440/8443 (TLS) are reachable from untrusted networks, and whether the default or any user has no password. Compare to the vendor advisory once published; none names this CVE yet.","fix":null,"status":"open","published_at":"2026-10-30T11:17:32+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","triaged_at":"2026-10-30T11:31:22+00:00","updated_at":"2026-10-30T11:32:09+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-10-30T11:31:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ClickHouse Server: unauthenticated network user can run arbitrary code","impact":"high","summary":"ClickHouse Server has a flaw that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server. The sources do not name the affected versions or the exact trigger.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["clickhouse","databases","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the ClickHouse Server","analyst_note":"Find the affected version ranges, the fixed release and the conditions that trigger the flaw in the NVD entry or the ClickHouse security advisory.","how_to_check":"- Confirm the running ClickHouse Server version with `clickhouse-server --version` and compare it against the vendor advisory.\n- Check whether the ClickHouse Server port is reachable from untrusted networks.\n- unknown for the exact conditions that trigger the flaw.","plain_action":"","needs_analyst":true,"not_affected_if":["no-network-exposure"],"who_is_affected":"ClickHouse Server instances reachable over the network are the concern, especially those exposed beyond a trusted network. The sources do not describe the exact configuration that triggers the flaw. Teams that run ClickHouse only on isolated, non-network-facing hosts are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000684,"input_tokens":4085,"output_tokens":551,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected version ranges, the fixed release and the conditions that trigger the flaw in the NVD entry or the ClickHouse security advisory.","search":"'-116366':12A,15A '-2026':11A,14A 'access':37B,75C 'affect':50B 'allow':69C 'arbitrari':8A,39B,78C 'certain':29B,66C 'clickhous':1A,16B,22B,62C,82C 'code':9A,40B,79C 'condit':30B,67C 'could':68C 'cve':10A,13A 'databas':17B 'discov':60C 'exact':54B 'execut':77C 'flaw':26B 'host':21B 'issu':57C 'let':31B 'name':48B 'network':4A,36B,74C 'run':7A,38B 'runtim':18B 'self':20B 'self-host':19B 'server':2A,23B,43B,63C,83C 'sourc':45B 'trigger':55B 'unauthent':3A,33B,71C 'user':5A,34B,72C 'version':51B","nicknames":[],"mitigations":[],"who_affected":"ClickHouse Server instances reachable over the network are the concern, especially those exposed beyond a trusted network. The sources do not describe the exact configuration that triggers the flaw. Teams that run ClickHouse only on isolated, non-network-facing hosts are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cb7ba516-3b07-4c98-b0c2-715220f1a8f6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116366","severity":null,"published_at":"2026-10-30T11:17:32+00:00","modified_at":"2026-10-30T11:17:32+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","fetched_at":"2026-10-30T11:29:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116366:1145","url":null,"severity":null,"published_at":"2026-10-30T11:32:09+00:00","modified_at":"2026-10-30T11:32:09+00:00","first_seen_at":"2026-10-30T11:32:09+00:00","fetched_at":"2026-10-30T11:32:09+00:00","note":"No primary source found: NVD page returned empty text, ClickHouse security changelog and GitHub advisories list no 2026 entry for this id. Affected versions, trigger and fix remain unknown. Do not conflate with CVE-2026-51992 (third-party reports, CREATE DICTIONARY SQLi, <=26.3.9.8), a different id and unconfirmed here. Settle by reading NVD record/CNA reference or a ClickHouse GHSA. Vendor says supported lines are 26.3, 26.8, 26.9, 26.10; unsupported lines get no fixes."}],"documents":[{"id":23151,"url":"https://clickhouse.com/docs/resources/changelogs/security-changelog","title":"ClickHouse security changelog (no entry for CVE-2026-116366 as of 2026-10-30)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}