CVE-2026-116366
Critical
Description
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
SeverityCritical
CVSS9.5
Exploit probability—
ProductClickHouse
PublishedOct 30, 2026
First seenNov 4, 2026
Weakness typeCWE-190Integer overflow
How to fix
Update
- ClickHouse ClickHouse26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable or later
- ClickHouse ClickHouse Cloud25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597, 26.10.2.84 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ClickHouse ClickHouse | 26.3 ≤ v < 26.3.62.3-lts, 26.8 ≤ v < 26.8.36.3-lts, 26.9 ≤ v < 26.9.27.3-stable, 26.10 ≤ v < 26.10.3.7-stable | 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable |
| ClickHouse ClickHouse Cloud | 25.12 ≤ v < 25.12.1.1713, 26.2 ≤ v < 26.2.1.835, 26.4 ≤ v < 26.4.1.2704, 26.6 ≤ v < 26.6.1.2439, 26.8 ≤ v < 26.8.1.597, 26.10 ≤ v < 26.10.2.84 | 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597, 26.10.2.84 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.