p PatchFirst

CVE-2026-116366

CVE-2026-116366 · Unauthenticated RCE vulnerability against ClickHouse Server

CVSS 9.5 · Critical · EPSS 1.0% · Public exploit · Fix available

Are you affected?

Check the installed version:

dpkg-query -W -f='${source:Package} ${binary:Package} ${Version}\n' | awk '$1=="clickhouse"'

The free check shows your server's rating and highlights whether clickhouse and the rest of its software need attention. No sign-up; server names and IP addresses are never sent. CVE IDs, fixed versions and recommendations come with paid monitoring.

curl -fsSL https://patchfirst.dev/check.sh | sh
Check your server for free →

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Published
Updated

Stack: system · database

Affected products and versions

  • clickhouse

    Versions
    • ≥ 26.3, < 26.3.62.3-lts: Affected (custom)
    • ≥ 26.8, < 26.8.36.3-lts: Affected (custom)
    • ≥ 26.9, < 26.9.27.3-stable: Affected (custom)
    • ≥ 26.10, < 26.10.3.7-stable: Affected (custom)

    Update to 26.10.3.7-stable; Update to 26.3.62.3-lts; Update to 26.8.36.3-lts; Update to 26.9.27.3-stable

  • clickhouse cloud

    Versions
    • ≥ 25.12, < 25.12.1.1713: Affected (custom)
    • ≥ 26.2, < 26.2.1.835: Affected (custom)
    • ≥ 26.4, < 26.4.1.2704: Affected (custom)
    • ≥ 26.6, < 26.6.1.2439: Affected (custom)
    • ≥ 26.8, < 26.8.1.597: Affected (custom)
    • ≥ 26.10, < 26.10.2.84: Affected (custom)

    Update to 25.12.1.1713; Update to 26.10.2.84; Update to 26.2.1.835; Update to 26.4.1.2704; Update to 26.6.1.2439; Update to 26.8.1.597

  • clickhouse Debian 12

    Versions
    • 18.16.1+ds-7.3
    • 18.16.1+ds-7.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • clickhouse Ubuntu 20.04 LTS

    Versions
    • 18.16.1+ds-5
    • 18.16.1+ds-5ubuntu1
    • 18.16.1+ds-5ubuntu2
    • 18.16.1+ds-6ubuntu1
    • 18.16.1+ds-7
    • 18.16.1+ds-7ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • clickhouse Ubuntu 24.04 LTS

    Versions
    • 18.16.1+ds-7.4
    • 18.16.1+ds-7.4build1
    • 18.16.1+ds-7.4build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →