Code Execution Vulnerability in ClickHouse Server by Altinity
CVE-2026-116366

9.5CRITICAL

Key Information:

Vendor

Clickhouse

Status
Clickhouse
Vendor
CVE Published:
30 October 2026

What is CVE-2026-116366?

A vulnerability has been identified in ClickHouse Server that may allow an unauthenticated attacker with network access to execute arbitrary code on the server. This poses significant risks, as it could lead to unauthorized control, data manipulation, and system compromise. Users are advised to review security practices and apply appropriate patches to mitigate potential threats. For further details, refer to the official security documentation.

Affected Version(s)

ClickHouse x86 26.3

ClickHouse x86 26.3 < 26.3.62.3-lts

ClickHouse x86 26.8 < 26.8.36.3-lts

References

https://github.com/ClickHouse/ClickHouse/blob/master/SECU...
https://clickhouse.com/docs/resources/changelogs/security...

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elshad Toklayev
.