ClickHouse Server: remote code execution

ClickHouse

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

Do this now

Upgrade ClickHouse to 26.10.3.7-stable and ClickHouse Cloud to 26.10.2.84, matching your release line (+8 more lines in Fix it).

Fix it

ClickHouse

On 26.3.xUpgrade to ClickHouse 26.3.62.3-lts
On 26.8.xUpgrade to ClickHouse 26.8.36.3-lts
On 26.9.xUpgrade to ClickHouse 26.9.27.3-stable
On 26.10.xUpgrade to ClickHouse 26.10.3.7-stable

ClickHouse Cloud

On 25.12.xUpgrade to ClickHouse Cloud 25.12.1.1713
On 26.2.xUpgrade to ClickHouse Cloud 26.2.1.835
On 26.4.xUpgrade to ClickHouse Cloud 26.4.1.2704
On 26.6.xUpgrade to ClickHouse Cloud 26.6.1.2439
On 26.8.xUpgrade to ClickHouse Cloud 26.8.1.597
On 26.10.xUpgrade to ClickHouse Cloud 26.10.2.84

First seen: 31 Oct 2026
Last update: 31 Oct 2026, 07:17 UTC
Fixed in: ClickHouse 26.10.3.7-stable
ClickHouse 26.9.27.3-stable
ClickHouse 26.8.36.3-lts
ClickHouse 26.3.62.3-lts
ClickHouse Cloud 26.10.2.84
ClickHouse Cloud 26.8.1.597
ClickHouse Cloud 26.6.1.2439
ClickHouse Cloud 26.4.1.2704
ClickHouse Cloud 26.2.1.835
ClickHouse Cloud 25.12.1.1713
Identifiers: CVE-2026-116366
CVSS: 9.5
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## ClickHouse Server: remote code execution
Severity: critical. Patch status: patched.
Affected: ClickHouse
Fixed in: ClickHouse 26.10.3.7-stable, ClickHouse 26.9.27.3-stable, ClickHouse 26.8.36.3-lts, ClickHouse 26.3.62.3-lts, ClickHouse Cloud 26.10.2.84, ClickHouse Cloud 26.8.1.597, ClickHouse Cloud 26.6.1.2439, ClickHouse Cloud 26.4.1.2704, ClickHouse Cloud 26.2.1.835, ClickHouse Cloud 25.12.1.1713
Ids: CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

## Steps
1. Search the repo, its CI and infra config for ClickHouse. If present, report the version in use and whether it's affected.
2. Fix by release line: ClickHouse: 26.10.x → 26.10.3.7-stable; 26.9.x → 26.9.27.3-stable; 26.8.x → 26.8.36.3-lts; 26.3.x → 26.3.62.3-lts. ClickHouse Cloud: 26.10.x → 26.10.2.84; 26.8.x → 26.8.1.597; 26.6.x → 26.6.1.2439; 26.4.x → 26.4.1.2704; 26.2.x → 26.2.1.835; 25.12.x → 25.12.1.1713.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| ClickHouse 26.10.x | fixed | 26.10.3.7-stable | — |
| ClickHouse 26.9.x | fixed | 26.9.27.3-stable | — |
| ClickHouse 26.8.x | fixed | 26.8.36.3-lts | — |
| ClickHouse 26.3.x | fixed | 26.3.62.3-lts | — |
| ClickHouse Cloud 26.10.x | fixed | 26.10.2.84 | — |
| ClickHouse Cloud 26.8.x | fixed | 26.8.1.597 | — |
| ClickHouse Cloud 26.6.x | fixed | 26.6.1.2439 | — |
| ClickHouse Cloud 26.4.x | fixed | 26.4.1.2704 | — |
| ClickHouse Cloud 26.2.x | fixed | 26.2.1.835 | — |
| ClickHouse Cloud 25.12.x | fixed | 25.12.1.1713 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-116366") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://clickhouse.com/docs/resources/changelogs/security-changelog https://nvd.nist.gov/vuln/detail/CVE-2026-116366
https://pwned.coffee/i/clickhouse-server-remote-code-execution-cve-2026-116366

Timeline

31 Oct 2026, 07:17 UTC
Fix status: unknown → patched.
31 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
ClickHouse 26.10 to before 26.10.3.7-stable 26.10.3.7-stable CVE record (CNA) checked 31 Oct
ClickHouse 26.9 to before 26.9.27.3-stable 26.9.27.3-stable CVE record (CNA) checked 31 Oct
ClickHouse 26.8 to before 26.8.36.3-lts 26.8.36.3-lts CVE record (CNA) checked 31 Oct
ClickHouse 26.3 to before 26.3.62.3-lts 26.3.62.3-lts CVE record (CNA) checked 31 Oct
ClickHouse Cloud 26.10 to before 26.10.2.84 26.10.2.84 CVE record (CNA) checked 31 Oct
ClickHouse Cloud 26.8 to before 26.8.1.597 26.8.1.597 CVE record (CNA) checked 31 Oct
ClickHouse Cloud 26.6 to before 26.6.1.2439 26.6.1.2439 CVE record (CNA) checked 31 Oct
ClickHouse Cloud 26.4 to before 26.4.1.2704 26.4.1.2704 CVE record (CNA) checked 31 Oct
ClickHouse Cloud 26.2 to before 26.2.1.835 26.2.1.835 CVE record (CNA) checked 31 Oct
ClickHouse Cloud 25.12 to before 25.12.1.1713 25.12.1.1713 CVE record (CNA) checked 31 Oct
Score: CVSS 9.5 (critical). CVSS 4.0 9.5 (CNA ClickHouse) for CVE-2026-116366
Last checked: 31 Oct 2026, 09:18 UTC

Product	Affected	Fixed in	Source
ClickHouse	26.10 to before 26.10.3.7-stable	26.10.3.7-stable	CVE record (CNA) checked 31 Oct
ClickHouse	26.9 to before 26.9.27.3-stable	26.9.27.3-stable	CVE record (CNA) checked 31 Oct
ClickHouse	26.8 to before 26.8.36.3-lts	26.8.36.3-lts	CVE record (CNA) checked 31 Oct
ClickHouse	26.3 to before 26.3.62.3-lts	26.3.62.3-lts	CVE record (CNA) checked 31 Oct
ClickHouse Cloud	26.10 to before 26.10.2.84	26.10.2.84	CVE record (CNA) checked 31 Oct
ClickHouse Cloud	26.8 to before 26.8.1.597	26.8.1.597	CVE record (CNA) checked 31 Oct
ClickHouse Cloud	26.6 to before 26.6.1.2439	26.6.1.2439	CVE record (CNA) checked 31 Oct
ClickHouse Cloud	26.4 to before 26.4.1.2704	26.4.1.2704	CVE record (CNA) checked 31 Oct
ClickHouse Cloud	26.2 to before 26.2.1.835	26.2.1.835	CVE record (CNA) checked 31 Oct
ClickHouse Cloud	25.12 to before 25.12.1.1713	25.12.1.1713	CVE record (CNA) checked 31 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee