Read the docs
TI-2024-14986 Aliases CVE-2024-22412

ClickHouse's Role-based Access Control is bypassed when query caching is enabled.

Priority MEDIUM 56CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00587 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ClickHouse (ClickHouse): 24.0.2.54535

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ClickHouseClickHouse= 23.1; before 24.0.2.5453524.0.2.54535Patch availableCNA
  • ClickHouse VendorClickHouse Affected = 23.1; before 24.0.2.54535 Fixed in 24.0.2.54535 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*23.3.0.0 to before 23.3.22.3; 23.8.0.0 to before 23.8.12.13; 23.12.0.0 to before 23.12.6.19; 24.0.0.0 to before 24.1.1.2048VulnerableClickHouse
cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*before 24.0.2.54535VulnerableClickHouse
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* Versions 23.3.0.0 to before 23.3.22.3; 23.8.0.0 to before 23.8.12.13; 23.12.0.0 to before 23.12.6.19; 24.0.0.0 to before 24.1.1.2048 Vulnerable ·ClickHouse
  • cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:* Versions before 24.0.2.54535 Vulnerable ·ClickHouse

Remediation

  • Fix · CNA ClickHouse (ClickHouse) Fixed in 24.0.2.54535

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22412

References

Exploit 1

Patch 1

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-27624 ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl. CVSS 3.1HIGH 7.5
  • TI-2018-10534 Improper input validation in ClickHouse CVSS 3.0CRITICAL 9.8
  • TI-2018-10533 Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. CVSS 3.0CRITICAL 9.8
  • TI-2019-12398 Out-of-bounds read in ClickHouse CVSS 3.1CRITICAL 9.8
  • TI-2019-12399 Buffer overflow in ClickHouse DB CVSS 4.0HIGH 8.2
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences