---
id: "CVE-2026-116366"
kind: "vulnerability"
aliases: ["CVE-2026-116366"]
title: "ClickHouse Server: unauthenticated network user can run arbitrary code"
severity: "critical"
cvss: 9.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["clickhouse", "databases", "runtime", "self-hosted"]
not_affected_if: ["no-network-exposure"]
published_at: "2026-10-30T11:17:32+00:00"
first_seen_at: "2026-10-30T11:29:51+00:00"
updated_at: "2026-10-30T11:32:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116366", "first_seen_at": "2026-10-30T11:29:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T11:32:09+00:00"}]
---

# ClickHouse Server: unauthenticated network user can run arbitrary code

ClickHouse Server has a flaw that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server. The sources do not name the affected versions or the exact trigger.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run 'clickhouse-server --version' (or SELECT version()). Check whether ports 9000 (native), 8123 (HTTP) and 9440/8443 (TLS) are reachable from untrusted networks, and whether the default or any user has no password. Compare to the vendor advisory once published; none names this CVE yet.

## Timeline

- 2026-10-30T11:29:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116366
- 2026-10-30T11:32:09+00:00 analyst — No primary source found: NVD page returned empty text, ClickHouse security changelog and GitHub advisories list no 2026 entry for this id. Affected versions, trigger and fix remain unknown. Do not conflate with CVE-2026-51992 (third-party reports, CREATE DICTIONARY SQLi, <=26.3.9.8), a different id and unconfirmed here. Settle by reading NVD record/CNA reference or a ClickHouse GHSA. Vendor says supported lines are 26.3, 26.8, 26.9, 26.10; unsupported lines get no fixes.

## Documents

- [mentions] ClickHouse security changelog (no entry for CVE-2026-116366 as of 2026-10-30) https://clickhouse.com/docs/resources/changelogs/security-changelog

## From the sources

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_