CVE-2026-116366

Description

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

OhShit! incidents

• ClickHouse patches unauthenticated server code execution across four release lines →

References

• www.cve.org/CVERecord ↗
• nvd.nist.gov/vuln/detail/CVE-2026-116366 ↗
• clickhouse.com/docs/resources/changelogs/security-changelog ↗
• github.com/ClickHouse/ClickHouse/blob/master/SECURITY.md ↗

Related CVEs

• CVE-2026-116127CVSS 9.1
• CVE-2026-119568vsftpd / vsftpdCVSS 9.1
• CVE-2026-119419cakephp / cakephpCVSS 9.2
• CVE-2026-119418cakephp / cakephpCVSS 9.2
• CVE-2025-31704Dahua / Intelligent Connection CenterCVSS 9.8
• CVE-2026-64618Apache Software Foundation / Apache FineractCVSS 9.8
• CVE-2026-82104Teltonika Networks / RUT · +13CVSS 9.4
• CVE-2026-103039Gravity Forms / Gravity FormsCVSS 9.8