External risk intelligence

ClickHouse Server Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-116366

ClickHouse is a database server designed for high-performance analytics. While typically deployed in internal, protected, or backend network segments rather than directly exposed to the public internet, it is a network-accessible service. It is plausibly reachable in some specific deployment architectures, but public internet exposure is not a standard or recommended configuration.

Integer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated vulnerability exists in ClickHouse Server, potentially allowing unauthorized code execution. This impacts database servers, which are critical for data analytics and management. The primary concern is to confirm if your ClickHouse instances are exposed in a way that could be targeted.

Unauthenticated code execution in database servers.
Potential impact on data analytics and management.
Confirm relevance and exposure to your environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially gain unauthorized access to a ClickHouse Server without needing any credentials, provided they can reach the server over the network. This exposure allows them to trigger a vulnerability that, if successful, could permit them to execute arbitrary code on the server.

Network access required.
Unauthenticated code execution triggered.
Server compromise is the risk.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated user with network access to the ClickHouse Server could execute arbitrary code, potentially impacting the integrity and availability of the server. This occurs under specific, though not fully detailed, conditions when the vulnerability is triggered.

Server code execution.
Network access with no authentication.
Compromise of server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

ClickHouse Server, a high-performance analytics database, is typically an internal or backend service. However, its network-accessible nature means it could be reachable in certain architectures, potentially allowing unauthenticated network access for arbitrary code execution. The first step is to identify all ClickHouse Server instances, assess their reachability and business criticality, identify the accountable owner, and then prioritize remediation efforts.

Identify ClickHouse instance owners.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ClickHouse Server?

ClickHouse Server is a high-performance, column-oriented database management system. Engineers use it to process and analyze massive volumes of data in real-time, often serving as the backend engine for complex analytical dashboards, log aggregation platforms, and business intelligence applications.

What does CVE-2026-116366 mean?

This vulnerability is classified as CWE-190, or Integer Overflow or Wraparound. In the context of CVE-2026-116366, this flaw allows an attacker to manipulate numerical values in a way that causes the software to miscalculate memory or logic operations, ultimately enabling them to run unauthorized commands on the server without providing login credentials.

How is this vulnerability triggered?

An attacker must have direct network connectivity to the ClickHouse Server instance to initiate the exploit. The vulnerability does not trigger if the server is isolated from external traffic or restricted to trusted internal networks, as the attacker needs a reachable network path to reach the service interface.

Is my ClickHouse Server at risk?

According to Halo Surface Signal, ClickHouse is generally intended for internal or protected backend use. If your database instance is reachable from the public internet, it faces a much higher risk. You should verify your specific network architecture to determine if your instance is inadvertently accessible beyond your internal perimeter.

How should I respond to this vulnerability?

Start by performing an inventory of all ClickHouse instances to understand where they are running and who owns them. Once identified, audit their network configurations to ensure they are properly firewalled or placed within restricted segments, then follow official project security guidance for any available updates or hardening steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.