Critical ClickHouse vulnerability: CVE-2026-116366 #
ClickHouse disclosed an integer overflow vulnerability in specific versions of ClickHouse Server. Under certain conditions, an unauthenticated attacker with network access could execute arbitrary code on the affected server. The vulnerability has been designated CVE-2026-116366 and has been rated critical with a CVSS score of 9.5.
The following versions are affected
- ClickHouse Server 26.3.x: Versions prior to 26.3.62.3-lts
- ClickHouse Server 26.8.x: Versions prior to 26.8.36.3-lts
- ClickHouse Server 26.9.x: Versions prior to 26.9.27.3-stable
- ClickHouse Server 26.10.x: Versions prior to 26.10.3.7-stable
What is ClickHouse? #
ClickHouse is an open-source, column-oriented database management system for real-time analytics.
What is the impact? #
Successful exploitation of this vulnerability would allow an unauthenticated remote attacker to execute arbitrary code on the affected server, leading to potential full system compromise and loss of data confidentiality and integrity.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- ClickHouse Server 26.3.x: Upgrade to version 26.3.62.3-lts or later.
- ClickHouse Server 26.8.x: Upgrade to version 26.8.36.3-lts or later.
- ClickHouse Server 26.9.x: Upgrade to version 26.9.27.3-stable or later.
- ClickHouse Server 26.10.x: Upgrade to version 26.10.3.7-stable or later.
Finding exposed ClickHouse installations with runZero #
From the Software Inventory, use the following query to locate systems running potentially vulnerable software:
vendor:="ClickHouse" AND product:="ClickHouse"
