01 · The Real Story
A database server that answers the internet becomes the attacker's shell
An integer overflow in ClickHouse Server can be triggered by unauthenticated network input, leading to arbitrary code execution on the server. Affected branches are 26.3.x < 26.3.62.3-lts, 26.8.x < 26.8.36.3-lts, 26.9.x < 26.9.27.3-stable, and 26.10.x < 26.10.3.7-stable. The vulnerable surface includes the native TCP port 9000 and HTTP interfaces on 8123/8443/9440.
There is no vendor CVSS score in the CVE record, but third-party ratings are critical: runZero reports 9.5, VulDB calls it critical, and CIRCL provides a CVSS 4.0 vector implying near-critical severity. That matches reality for any ClickHouse host that is reachable from a hostile network. The only real dampeners are the high attack complexity, absent public exploit, and the fact that many deployments do not expose ClickHouse beyond trusted segments.
"ClickHouse ships an unauthenticated integer-overflow RCE; any network exposure equals data-tier compromise."
02 · The Attack Path
4 steps from start to impact.
STEP 01
Locate an exposed ClickHouse service
Attacker scans for ClickHouse native TCP port 9000 and HTTP ports 8123/8443/9440 using Shodan, Censys, or naabu. A successful hit indicates a ClickHouse server listening on a network the attacker can reach.
Conditions required:
- Network reachability to at least one ClickHouse port
- ClickHouse bound to 0.0.0.0 or a network-exposed interface
Where this breaks in practice:
- Most production ClickHouse servers are bound to internal subnets or protected by security groups
- Public internet exposure is an exception, not the default
Detection/coverage: Shodan/Censys queries for port 9000/8123 and ClickHouse banners; runZero and Coralogix recommend scanning these ports on all ClickHouse hosts.
STEP 02
Deliver a malicious query or protocol message
The attacker sends a crafted SQL query or native-protocol message that causes an integer overflow in vulnerable ClickHouse parsing or format handling. No public exploit exists yet, so the exact trigger remains private or undisclosed.
Conditions required:
- ClickHouse version in one of the affected 26.3/26.8/26.9/26.10 ranges
- Interface accepts unauthenticated input
Where this breaks in practice:
- Attack complexity is high per the CVSS vector — the precise memory corruption condition is not publicly documented
- No public PoC is available as of this writing, lowering immediate exploitability
Detection/coverage: WAFs rarely decode ClickHouse's binary protocol; no signature coverage for this CVE known yet.
STEP 03
Achieve memory corruption and arbitrary code execution
The integer overflow corrupts memory and hijacks control flow in the ClickHouse server process. Code runs with the privileges of the ClickHouse service account — often root in Docker/cloud images or a dedicated
clickhouse user on Linux.Conditions required:
- Successful memory corruption under the server's process constraints
- Platform mitigations such as ASLR/PIE may need to be bypassed
Where this breaks in practice:
- Hardening details are deployment-specific; ClickHouse is a C++ binary so memory-corruption exploits are non-trivial
- EDR coverage on ClickHouse hosts is often absent
Detection/coverage: Endpoint detection may catch post-exploitation behavior, but pre-exploit detection is unlikely.
STEP 04
Exfiltrate data and pivot via seeded credentials
Once code executes, the attacker reads all tables, extracts embedded S3/Kafka/database credentials, and uses ClickHouse engine definitions to query external systems. This enables mass data egress and lateral movement.
Conditions required:
- ClickHouse integrations store cloud or upstream database credentials
- Network egress from the compromised host
Where this breaks in practice:
- Network segmentation and egress filtering may slow exfiltration
- Secret rotation can reduce stolen credential lifespan
Detection/coverage: SIEM can detect unusual query volume, credential use to external services, and large data transfers.
03 · Compensating Control
1
CRITICAL 9.0→HIGH 7.5
SEVERITY REDUCEDRestrict network access to all ClickHouse ports immediately — Block external access to 8123, 9000, 8443, and 9440 at the host firewall or security group; allow only trusted application/data subnets. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL. With this control alone, the vulnerability is not reachable from the internet, but internal unauthenticated attackers could still exploit it.
2
CRITICAL 9.0→IGNORE 0.0
SEVERITY REDUCEDUpgrade to fixed ClickHouse versions within 90 days — Apply vendor patches to move all affected hosts to 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, or 26.10.3.7-stable. This is the remediation step; noisgate remediation SLA for CRITICAL is ≤90 days. After patching, the underlying integer overflow is eliminated.
What doesn't work
- Disabling only the HTTP interface does not help — the native TCP port 9000 remains vulnerable and is often used by ClickHouse clients.
- A WAF or SQL-layer query allowlist is unlikely to stop the exploit because the overflow occurs in ClickHouse's parser/native protocol layer before SQL filtering.
- Relying on default ClickHouse authentication is not sufficient — many deployments run with no password and have the server bound to 0.0.0.0.
04 · Intelligence Metadata
The supporting signals.
| In-the-wild status | No known active exploitation or campaign reported as of 2026-10-30. |
|---|---|
| Public exploit availability | None found; VulDB states 'No exploit available'; no GitHub repos named after CVE located. |
| EPSS score | 0.00962 — 0.96% predicted 30-day exploitation probability, low. |
| KEV status | Not listed in CISA KEV as of 2026-10-30. |
| CVSS vector | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (CIRCL). runZero reports 9.5 using likely CVSS 3.x. |
| Affected versions | 26.3.x < 26.3.62.3-lts; 26.8.x < 26.8.36.3-lts; 26.9.x < 26.9.27.3-stable; 26.10.x < 26.10.3.7-stable. |
| Fixed versions | 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable. |
| Exposure data | No public Shodan/Censys counts in this assessment. Coralogix recommends re-checking suppressed scanner findings for ports 8123, 9000, 8443, 9440. |
| Disclosure date | 2026-10-30 (CVE published; reserved 2026-10-26). |
| Reporter / org | Not disclosed in available records; CNA appears to be ClickHouse maintainers. |
Sources.
05 · The Call
Final Verdict
= UNCHANGED to CRITICAL (9.0/10)
Why this verdict
- Assessed at CRITICAL — no vendor score: We start from the CVE record's unauthenticated network RCE and the CVSS 4.0 vector, which implies near-9.0 severity; runZero reports 9.5 critical.
- Role multiplier: ClickHouse is a production data-tier database in many deployments. Successful RCE gives full read/write access to analytics or transactional data, embedded S3/Kafka/database credentials, and a pivot to connected systems — mass data egress and lateral movement are plausible. This floors the verdict at HIGH/CRITICAL.
- Friction audit: The gate is network reachability to ports 8123/9000/8443/9440. Once reachable, no credentials or user interaction are required; the only remaining friction is high attack complexity and absent public exploit, which lowers the score from near-10 to 9.0 — not below critical.
Why not higher?
Score is not 10.0 because attack complexity is high and the precise integer-overflow conditions are not public. There is no known in-the-wild exploitation, EPSS is below 1%, and no public PoC exists, so we are not treating this as an actively weaponized event. Those frictions shave about a point off the upper critical range.
Why not lower?
This cannot be HIGH or below because it is an unauthenticated remote code execution bug in a database server. Once a host is reachable, no prior compromise is required; a hostile query can escalate directly to arbitrary code. ClickHouse often holds cloud/upstream credentials and production data, making domain- or fleet-scale data egress a plausible worst-case outcome.
06 · Verification
Crowdsourced verification payload.
Run on the ClickHouse server host as root or the clickhouse service user. Execute bash cve-2026-116366-check.sh with no arguments. The script exits 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN.
#!/usr/bin/env bash
# CVE-2026-116366 ClickHouse unauthenticated RCE version checker
# Run on the ClickHouse host. Requires local shell access and the clickhouse-server or clickhouse binary in PATH.
set -u
CLICKHOUSE_BIN="$(command -v clickhouse-server || command -v clickhouse || true)"
if [[ -z "$CLICKHOUSE_BIN" ]]; then
echo "UNKNOWN: clickhouse-server or clickhouse binary not found in PATH"
exit 2
fi
VERSION="$("$CLICKHOUSE_BIN" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
if [[ -z "$VERSION" ]]; then
echo "UNKNOWN: could not parse ClickHouse version"
exit 2
fi
echo "Detected ClickHouse version: $VERSION"
verlte() {
[[ "$1" == "$2" ]] && return 0
local IFS=.
local i ver1=($1) ver2=($2)
for ((i=0; i<${#ver1[@]}; i++)); do
if ((10#${ver1[i]} < 10#${ver2[i]})); then
return 0
elif ((10#${ver1[i]} > 10#${ver2[i]})); then
return 1
fi
done
return 0
}
if [[ "$VERSION" == 26.3.* ]] && ! verlte "26.3.62.3" "$VERSION"; then
echo "VULNERABLE: 26.3.x branch below 26.3.62.3-lts"
exit 1
elif [[ "$VERSION" == 26.8.* ]] && ! verlte "26.8.36.3" "$VERSION"; then
echo "VULNERABLE: 26.8.x branch below 26.8.36.3-lts"
exit 1
elif [[ "$VERSION" == 26.9.* ]] && ! verlte "26.9.27.3" "$VERSION"; then
echo "VULNERABLE: 26.9.x branch below 26.9.27.3-stable"
exit 1
elif [[ "$VERSION" == 26.10.* ]] && ! verlte "26.10.3.7" "$VERSION"; then
echo "VULNERABLE: 26.10.x branch below 26.10.3.7-stable"
exit 1
else
echo "PATCHED: version $VERSION is not in the affected ranges or is at/above fixed release"
exit 0
fi