Read the docs
TI-2026-82977 Aliases CVE-2026-116366GHSA-qhgw-ghp3-xh36

Unauthenticated remote code execution in ClickHouse Server

Priority MEDIUM 45CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

An integer overflow or wraparound (CWE-190) in ClickHouse Server lets an unauthenticated remote attacker with network access execute arbitrary code, under certain conditions. The affected ClickHouse and ClickHouse Cloud release lines are each fixed in the versions named in the solution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00962 61st percentileScored 2026-11-07
Fix Fixed ClickHouse (ClickHouse): 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable +1ClickHouse Cloud (ClickHouse): 25.12.1.1713, 26.2.1.835, 26.4.1.2704 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ClickHouseClickHouse26.3 to before 26.3.62.3-lts; 26.8 to before 26.8.36.3-lts; 26.9 to before 26.9.27.3-stable; 26.10 to before 26.10.3.7-stable26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stablePatch availableCNA
ClickHouseClickHouse Cloud25.12 to before 25.12.1.1713; 26.2 to before 26.2.1.835; 26.4 to before 26.4.1.2704; 26.6 to before 26.6.1.2439; 26.8 to before 26.8.1.597; 26.10 to before 26.10.2.8425.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597, 26.10.2.84Patch availableCNA
  • ClickHouse VendorClickHouse Affected 26.3 to before 26.3.62.3-lts; 26.8 to before 26.8.36.3-lts; 26.9 to before 26.9.27.3-stable; 26.10 to before 26.10.3.7-stable Fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable Patch available CNA
  • ClickHouse Cloud VendorClickHouse Affected 25.12 to before 25.12.1.1713; 26.2 to before 26.2.1.835; 26.4 to before 26.4.1.2704; 26.6 to before 26.6.1.2439; 26.8 to before 26.8.1.597; 26.10 to before 26.10.2.84 Fixed in 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597, 26.10.2.84 Patch available CNA

Remediation

Upgrade ClickHouse to 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable or 26.10.3.7-stable. Upgrade ClickHouse Cloud to 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597 or 26.10.2.84.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA ClickHouse (ClickHouse) Fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable
  • Fix · CNA ClickHouse Cloud (ClickHouse) Fixed in 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597, 26.10.2.84

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-116366
  2. 2026-10-30 Alias added: GHSA-qhgw-ghp3-xh36
  3. 2026-10-30 Fix available: [email protected], [email protected], [email protected] +3 · CNA
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-15707 ClickHouse Client Certificate Password Exposure CVSS 3.1HIGH 8.8
  • TI-2024-27624 ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl. CVSS 3.1HIGH 7.5
  • TI-2024-14986 ClickHouse's Role-based Access Control is bypassed when query caching is enabled. CVSS 3.1MEDIUM 4.9
  • TI-2018-10534 Improper input validation in ClickHouse CVSS 3.0CRITICAL 9.8
  • TI-2018-10533 Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences