CVE-2026-116366: Unauthenticated RCE in ClickHouse Server

CVE-2026-116366 identifies a remote code execution vulnerability in ClickHouse Server. An unauthenticated attacker with network access can execute arbitrary code on the server under certain conditions. This affects any organization using ClickHouse as a networked database, completely compromising the integrity and confidentiality of managed data.

The vulnerability is rated CVSS 9.5 and declared critical. Published on 2026-10-30, it generates three posts on X in the last 24 hours with coherent signals. No public exploit repositories are reported, however rapid information circulation quickly exposes vulnerable installations.

Defenders must act immediately: inventory all ClickHouse installations, identify versions in use, apply available patches (26.3.62.3-lts, 26.8.36.3-lts and others), verify network access controls to ClickHouse servers and monitor access logs for suspicious activity. Remediation is urgent given the criticality.

The official NVD description does not explicitly report all affected versions, suggesting that the ClickHouse vendor has provided details through its own channels. Check official vendor communications directly for the complete list of vulnerable versions and corresponding fixes.

An unauthenticated RCE vulnerability in a database server represents one of the most serious risks for IT infrastructure. The absolute priority is to verify exposure in your networks and apply patches as soon as possible, considering the ease of exploitation and the absence of authentication barriers.