{"id":"CVE-2026-116366","title":"Unauthenticated RCE vulnerability against ClickHouse Server","summary":"An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.","severity":"critical","cvss":9.5,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cvssSource":"cna","cwe":["CWE-190"],"vendor":"ClickHouse","product":"ClickHouse","affected":["ClickHouse >= 26.3 < 26.3.62.3-lts","ClickHouse >= 26.8 < 26.8.36.3-lts","ClickHouse >= 26.9 < 26.9.27.3-stable","ClickHouse >= 26.10 < 26.10.3.7-stable","ClickHouse >= 25.12 < 25.12.1.1713","ClickHouse >= 26.2 < 26.2.1.835","ClickHouse >= 26.4 < 26.4.1.2704","ClickHouse >= 26.6 < 26.6.1.2439","ClickHouse >= 26.8 < 26.8.1.597","ClickHouse >= 26.10 < 26.10.2.84"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T16:36:22.337339Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:36:32.335Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116366","references":[{"url":"https://github.com/ClickHouse/ClickHouse/blob/master/SECURITY.md"},{"url":"https://clickhouse.com/docs/resources/changelogs/security-changelog"}],"tags":["cve.org","exploit-available"],"epss":0.00962,"epssPercentile":0.61738,"exploits":{"github":1,"githubRepos":["https://github.com/googlesky/CVE-2026-116366"],"nuclei":["CVE-2026-116366"],"checkedAt":"2026-11-05T16:25:07.447Z"},"ingestedAt":"2026-11-05T16:24:31.079Z","slug":"CVE-2026-116366","body":"## Overview\n\nAn issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.\n\n## Affected\n\n- `ClickHouse >= 26.3 < 26.3.62.3-lts`\n- `ClickHouse >= 26.8 < 26.8.36.3-lts`\n- `ClickHouse >= 26.9 < 26.9.27.3-stable`\n- `ClickHouse >= 26.10 < 26.10.3.7-stable`\n- `ClickHouse >= 25.12 < 25.12.1.1713`\n- `ClickHouse >= 26.2 < 26.2.1.835`\n- `ClickHouse >= 26.4 < 26.4.1.2704`\n- `ClickHouse >= 26.6 < 26.6.1.2439`\n- `ClickHouse >= 26.8 < 26.8.1.597`\n- `ClickHouse >= 26.10 < 26.10.2.84`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":64,"depthScoreParts":{"impact":52.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}