CVE-2026-116366

EUVD-2026-113778
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
ClickHouseCNA
9.5 CRITICAL
NETWORK
HIGH
NONE
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
clickhouseclickhouse
25.12 ≤
𝑥
< 25.12.1.1713
CNA
clickhouseclickhouse
26.2 ≤
𝑥
< 26.2.1.835
CNA
clickhouseclickhouse
26.4 ≤
𝑥
< 26.4.1.2704
CNA
clickhouseclickhouse
26.6 ≤
𝑥
< 26.6.1.2439
CNA
clickhouseclickhouse
26.8 ≤
𝑥
< 26.8.1.597
CNA
clickhouseclickhouse
26.10 ≤
𝑥
< 26.10.2.84
CNA
Common Weakness Enumeration
References
https://clickhouse.com/docs/resources/changelogs/security-changelog
https://github.com/ClickHouse/ClickHouse/blob/master/SECURITY.md