CVE-2026-116366CVSS 9.5Unauthenticated server RCE
The vendor CNA identifies an integer overflow or wraparound; an unauthenticated network user can execute code under undisclosed conditions. The 9.5 score is CVSS v4.0.
ClickHouse patches unauthenticated server code execution across four release lines
ClickHouse discloses CVE-2026-116366, a conditional unauthenticated network RCE. Four open-source release lines have fixes; the vendor says Cloud and BYOC are already patched. The triggering conditions and affected interface are not disclosed, and exploitation is unconfirmed.
- Disclosed
- Oct 30, 2026
- Public disclosure date
- Severity
- CVSS 9.5
- 1 CVE tracked here
- Splash zone
- Network-reachable self-managed ClickHouse servers before the listed fixes; exact trigger conditions undisclosed
- ClickHouse · database · RCE
- In the wild
- Unknown
- No vendor exploitation confirmation; CISA's October 30 assessment lists none.
What happened
The disclosed scope warrants L3 because ClickHouse is a mainstream database and the vendor confirms unauthenticated code execution. Authentication and user interaction are not required in the CNA vector, but attack complexity is high. Neither that score nor network exposure establishes that every reachable installation can be exploited: the vendor has not described the additional conditions.
No public exploit or victim count is established by these sources. The CISA assessment in the record is an October 30 snapshot, not proof that attacks cannot occur. No incident-specific hunting indicators are published there. The vendor does not connect this flaw to the separate Brotli vulnerability; do not infer a shared cause from nearby release dates.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| ClickHouse 26.10 stable | 26.10.3.7 | Patched |
| ClickHouse 26.9 stable | 26.9.27.3 | Patched |
| ClickHouse 26.8 LTS | 26.8.36.3 | Patched |
| ClickHouse 26.3 LTS | 26.3.62.3 | Patched |
| Other open-source release lines | No fix | Move to a supported line |
Crime-scene timeline
Oct 25, 2026
Fixed stable packages released
Package index dates 26.10.3.7 and 26.9.27.3 to this day; a package date is not the disclosure date.
Oct 26, 2026
Fixed LTS packages released
Package index dates 26.8.36.3 and 26.3.62.3 to this day.
Oct 30, 10:59 UTC
Vendor records public disclosure
The CNA public date and October 30 security changelog establish the disclosure day; the CVE record was published at 11:00 UTC.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.