CVE-2026-116366: Unauthenticated RCE vulnerability against…

CVE-2026-116366EUVD-2026-113778GHSA-QHGW-GHP3-XH36VulnerabilityPublished

Unauthenticated RCE vulnerability against ClickHouse Server

ClickHouse Server 26.3 through 26.10 lines before their fixed builds, and ClickHouse Cloud, are affected. Fixed in open-source 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

9.5CriticalCNA

Exploited: No known exploitation
Fix: Fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable, 25.12.1.1713, and 5 more
Who is exposed: Not reported

Do first: Upgrade to a fixed version: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable, 25.12.1.1713, or one of 5 more.

Published: Oct 30, 2026
Last modified: Oct 30, 2026
: Published
: Not listed in CISA KEV
: 27/100
: Unclear
Fix: Fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable, 25.12.1.1713, and 5 more
: 1 proof of concept on GitHub, 1 Nuclei template
On X: View the cve.now post

Exploitation: none
Automatable: no
Technical impact: total

Summary

ClickHouse Server, an open-source database management system, is affected by this vulnerability. Under certain conditions, an unauthenticated attacker with network access to the server could execute arbitrary code on it.

Read the original description

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

What to do

Upgrade to a fixed version: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable, 25.12.1.1713, or one of 5 more.

Timeline

Oct 30, 2026, 11:00 AM UTCCVE published
Oct 30, 2026, 11:08 AM UTCFirst seen by cve.now
Oct 30, 2026, 11:20 AM UTCPosted on X by cve.now
Oct 30, 2026, 4:36 PM UTCCISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
Oct 30, 2026, 4:36 PM UTCRecord last updated

Affected versions

ClickHouse
From 26.3 · fixed in 26.3.62.3-lts; From 26.8 · fixed in 26.8.36.3-lts; From 26.9 · fixed in 26.9.27.3-stable; From 26.10 · fixed in 26.10.3.7-stable
ClickHouse
From 25.12 · fixed in 25.12.1.1713; From 26.2 · fixed in 26.2.1.835; From 26.4 · fixed in 26.4.1.2704; From 26.6 · fixed in 26.6.1.2439; From 26.8 · fixed in 26.8.1.597; From 26.10 · fixed in 26.10.2.84

On X 5

Evidence 4

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about CVE-2026-116366

What does this mean?

An unauthenticated user with network access can execute arbitrary code on the ClickHouse Server without logging in.Source: clickhouse.com

Am I affected, and how do I check?

Open-source ClickHouse Server builds in the 26.3, 26.8, 26.9 and 26.10 lines before their fixed releases are affected, as are ClickHouse Cloud builds before the fixed release listed for each line. To check a server, run SELECT version() in clickhouse-client and compare the result with the fixed versions.Source: clickhouse.com

What should I do about it?

Upgrade to the fixed build on the same release line: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, or 26.10.3.7-stable.Source: clickhouse.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a Nuclei template, a proof of concept on GitHub).Source: cve.now feed data