ClickHouse Server: Unauthenticated remote code execution (CVE-2026-116366)
CVE-2026-116366 is a high-severity vulnerability in ClickHouse Server that allows an unauthenticated user with network access to execute arbitrary code.
CVE search metadata
CVE search record: CVE-2026-116366. KEV: no. Brief: ClickHouse Server: Unauthenticated remote code execution (CVE-2026-116366). Brief link: https://feed.craftedsignal.io/briefs/2026-10-clickhouse-rce/
Triage facts
Revision 2- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 6 public sources
- Freshness
- Revision 2Oct 30, 16:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C2Likely
Revision history 1 entry · Revision 2
- Revision 2
new vendor
Changed: affected_vendors, claim_state, lastmod, references, updates
Sources: 1
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the server. The vulnerability is reported with a CVSS 4.0 score of 9.5 and a high-severity rating.