CVE-2026-116366

critical

Description

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

References

https://github.com/ClickHouse/ClickHouse/blob/master/SECURITY.md

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113778

https://clickhouse.com/docs/resources/changelogs/security-changelog

Details

Source: Mitre, NVD

Published: 2026-10-30

Updated: 2026-10-30

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.5

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H