UBUNTU-CVE-2026-116366: Critical severity ubuntu/clickhouse vulnerability
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
ClickHouse Server instances that are reachable over the network are exposed, because exploitation is described as possible for an unauthenticated user with network access. The supplied data does not identify any additional configuration prerequisites.
What level of access does an attacker need?
An attacker needs network access to the ClickHouse Server. No authentication, privileges, or user interaction are required, although the attack complexity is rated high.
What is the potential impact if exploitation succeeds?
Successful exploitation could allow arbitrary code execution on the ClickHouse Server. The provided severity vector indicates high impact to confidentiality, integrity, and availability for both the vulnerable system and subsequent systems.