Unauthenticated RCE vulnerability against ClickHouse Server
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A newly published CVE, CVE-2026-116366, affects ClickHouse Server, the open-source database system. Under certain conditions, an unauthenticated attacker with network access could execute arbitrary code on the server. CISA's assessment rates it as non-automatable with total technical impact, and no public exploit is listed.