ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366)
ClickHouse Server
ClickHouse fixed a flaw in ClickHouse Server that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server (CVE-2026-116366, CWE-190 integer overflow, CVSS 4.0 score 9.5 critical). Fixes shipped Oct 30 2026 in v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments, so self-hosted servers are the ones that need upgrading. The bug was reported by researcher Elshad Toklayev through ClickHouse's bug bounty. No public exploit or in-the-wild exploitation has been reported.
Why this severity: CVSS 4.0 9.5 (network, no auth, high attack complexity); exploitable only 'under certain conditions' per the vendor
- Started
- Oct 30, 2026
Affected
- ClickHouse 26.3 before 26.3.62.3-lts
- ClickHouse 26.8 before 26.8.36.3-lts
- ClickHouse 26.9 before 26.9.27.3-stable
- ClickHouse 26.10 before 26.10.3.7-stable
Fixed in
- 26.3.62.3-lts
- 26.8.36.3-lts
- 26.9.27.3-stable
- 26.10.3.7-stable
- ClickHouse Cloud and BYOC (fixed by vendor)
Timeline2
ClickHouse publishes CVE-2026-116366 in its security changelog: unauthenticated network RCE in ClickHouse Server, fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable; Cloud and BYOC already patched.
The CVE record is published to NVD with a CVSS 4.0 score of 9.5 (critical), CWE-190.
Advisories2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
