ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366) ยท updates https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366 ClickHouse fixed a flaw in ClickHouse Server that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server (CVE-2026-116366, CWE-190 integer overflow, CVSS 4.0 score 9.5 critical). Fixes shipped Oct 30 2026 in v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments, so self-hosted servers are the ones that need upgrading. The bug was reported by researcher Elshad Toklayev through ClickHouse's bug bounty. No public exploit or in-the-wild exploitation has been reported. en Fri, 30 Oct 2026 00:00:00 GMT ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366): ClickHouse publishes CVE-2026-116366 in its security changelog: unauthenticated network RCE in ClickHouse Server, fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable; Cloud and BYOC already patched. https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366 https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366#2026-10-30-3b9fe113 Fri, 30 Oct 2026 00:00:00 GMT critical <p><a href="https://clickhouse.com/docs/resources/changelogs/security-changelog">Source</a></p> ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366): The CVE record is published to NVD with a CVSS 4.0 score of 9.5 (critical), CWE-190. https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366 https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366#2026-10-30-3eb54cb1 Fri, 30 Oct 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-116366">Source</a></p>