{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366) · updates",
  "home_page_url": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366",
  "feed_url": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366/feed.json",
  "description": "ClickHouse fixed a flaw in ClickHouse Server that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server (CVE-2026-116366, CWE-190 integer overflow, CVSS 4.0 score 9.5 critical). Fixes shipped Oct 30 2026 in v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments, so self-hosted servers are the ones that need upgrading. The bug was reported by researcher Elshad Toklayev through ClickHouse's bug bounty. No public exploit or in-the-wild exploitation has been reported.",
  "language": "en",
  "_pwn": {
    "slug": "clickhouse-server-unauth-rce-cve-2026-116366",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366/feed.xml",
    "llms": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366/llms.txt",
    "json": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366#2026-10-30-3b9fe113",
      "url": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366#2026-10-30-3b9fe113",
      "title": "ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366): ClickHouse publishes CVE-2026-116366 in its security changelog: unauthenticated network RCE in ClickHouse Server, fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable; Cloud and BYOC already patched.",
      "content_text": "ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366): ClickHouse publishes CVE-2026-116366 in its security changelog: unauthenticated network RCE in ClickHouse Server, fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable; Cloud and BYOC already patched.\n\nSource: https://clickhouse.com/docs/resources/changelogs/security-changelog",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://clickhouse.com/docs/resources/changelogs/security-changelog",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366#2026-10-30-3eb54cb1",
      "url": "https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366#2026-10-30-3eb54cb1",
      "title": "ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366): The CVE record is published to NVD with a CVSS 4.0 score of 9.5 (critical), CWE-190.",
      "content_text": "ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366): The CVE record is published to NVD with a CVSS 4.0 score of 9.5 (critical), CWE-190.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-116366",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116366",
      "tags": [
        "critical"
      ]
    }
  ]
}