CVE-2026-116366: Unauthenticated RCE vulnerability against ClickHouse Server
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
ClickHouse Server instances with network access available to unauthenticated users are exposed under the unspecified conditions required for exploitation. The provided data identifies Debian ClickHouse packages but does not identify affected or fixed versions.
What access does an attacker need?
An attacker needs network access to the ClickHouse Server. No authentication, privileges, or user interaction are required according to the supplied severity vector.
What is the potential impact of successful exploitation?
Successful exploitation could let an unauthenticated remote attacker execute arbitrary code on the ClickHouse Server. The severity data indicates potential high impact to confidentiality, integrity, and availability, including subsequent systems.