CVE-2026-116366

published 2026-10-30

CVE-2026-116366: An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary…

Priority P2 67 critical 9.5 CVSS 4.0

AV N AC H AT N PR N UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
clickhouse	clickhouse	>= 26.10 < 26.10.3.7-stable	26.10.3.7-stable
clickhouse	clickhouse	>= 26.3 < 26.3.62.3-lts	26.3.62.3-lts
clickhouse	clickhouse	>= 26.8 < 26.8.36.3-lts	26.8.36.3-lts
clickhouse	clickhouse	>= 26.9 < 26.9.27.3-stable	26.9.27.3-stable
clickhouse	clickhouse_cloud	>= 25.12 < 25.12.1.1713	25.12.1.1713
clickhouse	clickhouse_cloud	>= 26.10 < 26.10.2.84	26.10.2.84
clickhouse	clickhouse_cloud	>= 26.2 < 26.2.1.835	26.2.1.835
clickhouse	clickhouse_cloud	>= 26.4 < 26.4.1.2704	26.4.1.2704
clickhouse	clickhouse_cloud	>= 26.6 < 26.6.1.2439	26.6.1.2439
clickhouse	clickhouse_cloud	>= 26.8 < 26.8.1.597	26.8.1.597

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-190