# ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366) · pwn.watch > ClickHouse fixed a flaw in ClickHouse Server that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server (CVE-2026-116366, CWE-190 integer overflow, CVSS 4.0 score 9.5 critical). Fixes shipped Oct 30 2026 in v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments, so self-hosted servers are the ones that need upgrading. The bug was reported by researcher Elshad Toklayev through ClickHouse's bug bounty. No public exploit or in-the-wild exploitation has been reported. Page: https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366 · generated 2026-10-30T16:22:57.349Z ## Status - Severity: critical · status: live · patch: patched - Product: ClickHouse Server - Started: 2026-10-30 - CVEs: CVE-2026-116366 - Affected: ClickHouse 26.3 before 26.3.62.3-lts; ClickHouse 26.8 before 26.8.36.3-lts; ClickHouse 26.9 before 26.9.27.3-stable; ClickHouse 26.10 before 26.10.3.7-stable - Fixed in: 26.3.62.3-lts; 26.8.36.3-lts; 26.9.27.3-stable; 26.10.3.7-stable; ClickHouse Cloud and BYOC (fixed by vendor) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366/feed.xml - JSON Feed: https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366.json - This file: https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366/llms.txt ## Updates (newest first) - 2026-10-30: ClickHouse publishes CVE-2026-116366 in its security changelog: unauthenticated network RCE in ClickHouse Server, fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable; Cloud and BYOC already patched. (https://clickhouse.com/docs/resources/changelogs/security-changelog) - 2026-10-30: The CVE record is published to NVD with a CVSS 4.0 score of 9.5 (critical), CWE-190. (https://nvd.nist.gov/vuln/detail/CVE-2026-116366) ## Fix brief # Security brief: ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366) Source: https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366 · status: live · severity: critical · updated Oct 30, 2026, 15:58 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is ClickHouse fixed a flaw in ClickHouse Server that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server (CVE-2026-116366, CWE-190 integer overflow, CVSS 4.0 score 9.5 critical). Fixes shipped Oct 30 2026 in v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments, so self-hosted servers are the ones that need upgrading. The bug was reported by researcher Elshad Toklayev through ClickHouse's bug bounty. No public exploit or in-the-wild exploitation has been reported. Severity detail: CVSS 4.0 9.5 (network, no auth, high attack complexity); exploitable only 'under certain conditions' per the vendor - Product: ClickHouse Server - CVE / advisory ids: CVE-2026-116366 ## Affected versions - ClickHouse 26.3 before 26.3.62.3-lts - ClickHouse 26.8 before 26.8.36.3-lts - ClickHouse 26.9 before 26.9.27.3-stable - ClickHouse 26.10 before 26.10.3.7-stable ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 26.3.62.3-lts - 26.8.36.3-lts - 26.9.27.3-stable - 26.10.3.7-stable - ClickHouse Cloud and BYOC (fixed by vendor) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes If you self-host ClickHouse, run SELECT version() on every node and upgrade to 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable or 26.10.3.7-stable (or newer). Until then, keep the native (9000) and HTTP (8123) interfaces off the internet and restricted to trusted networks. ClickHouse Cloud and BYOC need no action. ## Latest updates - Oct 30, 2026: ClickHouse publishes CVE-2026-116366 in its security changelog: unauthenticated network RCE in ClickHouse Server, fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable; Cloud and BYOC already patched. - Oct 30, 2026: The CVE record is published to NVD with a CVSS 4.0 score of 9.5 (critical), CWE-190. ## Advisories - [ClickHouse security changelog: CVE-2026-116366](https://clickhouse.com/docs/resources/changelogs/security-changelog) (ClickHouse) - [CVE-2026-116366](https://nvd.nist.gov/vuln/detail/CVE-2026-116366) (NVD) --- Machine-readable: https://pwn.watch/i/clickhouse-server-unauth-rce-cve-2026-116366.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.