ClickHouse Server unauthenticated remote code execution: CVE-2026-116366

• You self-host ClickHouse on 26.3, 26.8, 26.9 or 26.10

  Packages, Docker, Kubernetes operator, bare binary

  Act now

  Upgrade to the fixed release for your line. Fixed versions

• You self-host ClickHouse 26.7 or older

  Any unsupported release, including 25.3 and 25.8 LTS

  Act now

  No fix is coming for your release. Move to 26.8.36.3-lts or a newer supported line, and restrict network access until you do.

• Your ClickHouse ports are reachable from the internet

  Public IP, published Docker port, open security group

  Act now

  Upgrade these first. If you cannot today, close the ports now. How

• You embed or ship ClickHouse in a product or appliance

  Bundled binary or image in your own release

  Update needed

  Rebuild with a fixed ClickHouse release and tell your customers which version of your product carries it.

• You use ClickHouse Cloud or BYOC

  Managed by ClickHouse

  Protected

  No action. ClickHouse has already patched every managed service.

1. 01

   Find every ClickHouse node and its version

   Check each replica and shard, not just the one your application talks to. Include Keeper-adjacent and test clusters.

   ShellCopy

   # From any client that can log in
   clickhouse-client --query "SELECT version()"
   
   # Every node in a cluster at once (replace <cluster> with your cluster name)
   clickhouse-client --query "SELECT hostName(), version()
     FROM clusterAllReplicas('<cluster>', system.one) ORDER BY 1"
   
   # Docker: the image tag on each running container
   docker ps --format '{{.Names}}\t{{.Image}}' | grep -i clickhouse
   
   # Kubernetes: the image on every ClickHouse pod
   kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}' \
     | grep -i clickhouse

2. 02

   Find which nodes are reachable from untrusted networks

   A listener on 0.0.0.0 or :: is reachable from wherever the host is. The official Docker image listens on all interfaces by default, so a published port is an exposed port. Confirm from outside with your cloud security group or an external port scan.

   ShellCopy

   # Which addresses and ports the server listens on
   sudo ss -ltnp | grep clickhouse
   
   # Any listen_host overrides in the server config
   grep -rn "listen_host" /etc/clickhouse-server/

3. 03

   Upgrade, exposed nodes first

   Move to the fixed release for your line in the table below, from packages.clickhouse.com or the Docker image. Restart the server; the old binary stays loaded until you do.
4. 04

   Confirm the running version

   Rerun SELECT version() on every node. A Docker tag like 26.8 only moves when you pull it again.

ClickHouse only fixes the release lines listed as supported in SECURITY.md. The CVE record marks every version outside the four fixed ranges as affected by default, and the vendor has not said that any older release is safe. If you are on 26.7, 25.8 LTS or anything earlier, 26.8 LTS is the shortest supported step.

• No login needed. The CVE record says an unauthenticated user with network access can run arbitrary code on the server under certain conditions.
• The bug is an integer overflow (CWE-190). ClickHouse has not named the component, protocol or port.
• Hard, not impossible. The CVSS 4.0 vector rates attack complexity high, which usually means the attacker must defeat memory protections such as ASLR. Every other metric is at its worst: network reachable, no privileges, no user interaction, high impact on the server and on systems beyond it.
• Code runs as the server. Whoever succeeds runs as the clickhouse user, which can read every table on disk, the server configuration and any credentials it holds for S3, Kafka, dictionaries or remote databases.
• The patch is still private. ClickHouse says the pull request will be made public after 13 November 2026. Once it is, anyone can study the fix to locate the bug.
• Not known to be exploited. No in-the-wild use is reported, and the CVE was not in CISA KEV as of 4 November 2026. ClickHouse says it has no evidence of exploitation in ClickHouse Cloud. The bug was reported by Elshad Toklayev through ClickHouse's bug bounty.
• Public code carries this CVE number, but targets a different flaw. A third-party proof of concept and a Nuclei template labelled CVE-2026-116366 send a crafted Brotli-compressed body to the HTTP interface. That is the bundled Brotli decoder bug, which ClickHouse publishes as a separate CVE-2026-111497 with its own notice, while it classes CVE-2026-116366 as an integer overflow. The public code shows a denial of service, not code execution. ClickHouse has not confirmed the root cause of CVE-2026-116366, so a server that passes these checks is not proven safe. Only the fixed version is.

• Block every ClickHouse port, not two. Because the vulnerable interface is undisclosed, restrict all of them at the firewall or security group: 8123 and 8443 (HTTP), 9000 and 9440 (native), 9004 (MySQL), 9005 (PostgreSQL), 9009 and 9010 (interserver), 9100 (gRPC) and any custom port in your config. See ClickHouse's port list.
• Allow only known clients. Permit the application hosts, other replicas and shards, and your administrators' network. Deny everything else, including other workloads in the same VPC that have no reason to connect.
• Bind to private addresses. Set listen_host to a private interface instead of 0.0.0.0, and stop publishing ClickHouse ports from Docker hosts that do not need them.
• Do not count on user-level controls. Passwords and the networks setting in users.xml apply when a user logs in. This bug needs no login, so only a network-level block helps.

For the previous unauthenticated native-interface bug, CVE-2024-6873, ClickHouse's own workaround was to lock the native interface down to trusted IP addresses until patched. The advice here extends that to every listener because this time the interface is not named.

1. Unexplained server crashes

Exploits rated high complexity often take several tries, and a failed try against a memory bug usually crashes the process. Crashes with no matching query in your application logs, especially on exposed nodes, deserve a closer look.

# Fatal signals in the server error log, including rotated files
zgrep -h -E "Received signal|<Fatal>" /var/log/clickhouse-server/clickhouse-server.err.log*

# The same crashes from inside ClickHouse, if crash_log is enabled
clickhouse-client --query "SELECT event_time, signal, query_id, version
  FROM system.crash_log ORDER BY event_time DESC LIMIT 50"

2. Processes the server should not start

A successful attack runs code as the clickhouse user. Shells, downloaders or network tools running as that user are a strong sign.

# Everything running as the clickhouse user. Expect clickhouse-server (often
# twice: watchdog and server) and any configured odbc or library bridge.
ps -u clickhouse -o pid,ppid,etime,args

3. Connections from unexpected sources

Review firewall or flow logs for connections to ClickHouse ports from addresses outside your application and cluster ranges. Because the attack needs no login, it may not appear in system.session_log or system.query_log.

If you find signs of compromise, treat the host as lost: rebuild it from a fixed release, and rotate every credential the server held, including ClickHouse user passwords, S3 and cloud keys, Kafka and remote database credentials, and interserver secrets.

1. 2026-10-25

   2026-10-25

   ClickHouse merges an upgrade of its bundled Brotli decoder for CVE-2026-111497, with backports labelled for 26.10, 26.9, 26.8 and 26.3.

   ctxsec

2. 2026-10-26

   2026-10-26

   ClickHouse, as CNA, reserves CVE-2026-116366.

   CVE record

3. 2026-10-30

   2026-10-3011:00 UTC

   ClickHouse publishes CVE-2026-116366: unauthenticated RCE, CVSS 4.0 9.5, fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable. Cloud and BYOC already patched.

   ClickHouse Trust Center

4. 2026-10-31

   2026-10-3106:32 UTC

   A public proof of concept labelled CVE-2026-116366 appears on GitHub. It exercises the bundled Brotli decoder flaw (CVE-2026-111497) and demonstrates a denial of service, not code execution.

   GitHub

5. 2026-11-02

   2026-11-02

   ProjectDiscovery adds a Nuclei template under CVE-2026-116366 that sends the same Brotli payload to the HTTP interface.

   nuclei-templates

6. 2026-11-13

   2026-11-13

   Earliest date ClickHouse will make the pull request containing the patch public.

   ClickHouse Trust Center

• ClickHouse Trust Center: CVE-2026-116366, 30 October 2026Vendor notice: fixed versions, Cloud and BYOC status, patch disclosure date and the companion Brotli fix.
• CVE-2026-116366 recordPublished by ClickHouse as CNA: CWE-190, CVSS 4.0 vector, affected ranges, default status and reporter credit.
• ClickHouse SECURITY.mdWhich release lines receive security fixes.
• ClickHouse security changelogVendor history of ClickHouse CVEs and their fixed releases.
• NVD: CVE-2026-116366NIST entry. Analysis pending at the time of writing.
• CISA Known Exploited Vulnerabilities catalogCVE-2026-116366 not listed as of the 4 November 2026 release.
• Public proof of concept labelled CVE-2026-116366, 31 October 2026Third-party code targeting the bundled Brotli v1.2.0 decoder over HTTP. Demonstrates a denial of service; code execution is not shown.
• ProjectDiscovery Nuclei template for CVE-2026-116366Intrusive scanner check added on 2 November 2026 that sends a crafted Brotli request body.
• ClickHouse network portsEvery default listener a self-hosted server can open.
• ClickHouse Docker image network configThe official image listens on all interfaces.
• ctxsec on CVE-2026-111497 in ClickHouseJFrog's single-request ClickHouse crash and the merged Brotli fix.
• ClickHouse advisory for CVE-2024-6873The previous unauthenticated native-interface bug and the vendor's workaround at the time.