ClickHouse Server: Unauthenticated remote code execution

Summary

ClickHouse Server contains a vulnerability that, under certain conditions, allows an unauthenticated attacker with network access to execute arbitrary code on the server. The CVE record rates it as critical (CVSS 4.0 base score 9.5) and classifies it as CWE-190 (integer overflow or wraparound). The vendor has not disclosed the exact trigger conditions, and no confirmed exploitation or public proof of concept is known at the time of writing.

Affected

• ClickHouse Server 26.3 before 26.3.62.3-lts
• ClickHouse Server 26.8 before 26.8.36.3-lts
• ClickHouse Server 26.9 before 26.9.27.3-stable
• ClickHouse Server 26.10 before 26.10.3.7-stable
• Older and unsupported branches: Unknown. Treat them as vulnerable.
• ClickHouse Cloud and BYOC: Vendor reports these deployments are already patched.

Fixed in

• ClickHouse Server 26.3.62.3-lts
• ClickHouse Server 26.8.36.3-lts
• ClickHouse Server 26.9.27.3-stable
• ClickHouse Server 26.10.3.7-stable
• ClickHouse Cloud and BYOC: patched by the vendor

Workaround

Unknown. The vendor documents no workaround.

• Interim measure (not from the vendor): restrict network access to ClickHouse ports to trusted hosts until the upgrade is complete.

Exploitation

• No evidence of exploitation according to the vendor.
• CISA KEV: not listed.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No usable public proof of concept found.

Our recommendation

• Inventory all ClickHouse instances, including Docker, Kubernetes and test or analytics environments.
• Upgrade to the fixed build for your release branch, or to the latest build.
• Restrict network access to ClickHouse ports now, especially for any internet-facing address.
• Review logs on ClickHouse hosts for unusual activity.
• Re-check the NVD and vendor pages for changes to conditions or affected versions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  googlesky/CVE-2026-116366

Research sources

• ClickHouse Security Changelog clickhouse.com
• ClickHouse SECURITY.md github.com
• ClickHouse Trust Center trust.clickhouse.com
• Strix CVE entry www.strix.ai
• CVE threatint entry cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:28.