CVE-2026-116366

Unauthenticated RCE vulnerability against ClickHouse Server

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Affected

ClickHouse · ClickHouse Cloud

CVSS v4.0 ClickHouse

9.5 CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Published

2026-10-30

Proof-of-concept exploits (1)

• googlesky/CVE-2026-116366Repo stars 0★ · pushed 2026-10-31 · find archive

CVE references

• https://clickhouse.com/docs/resources/changelogs/security-changelogREFERENCE
• ClickHouse/ClickHouse/blob/master/SECURITY.mdREFERENCE

References

• CVE Record
• NVD entry

Related

• CVE-2026-104623
• CVE-2026-110264
• CVE-2026-115560