Threat Advisory – ClickHouse CVE-2026-116366: Unauthenticated Remote Code Execution

CVE-2026-116366 is a critical ClickHouse Server vulnerability, disclosed on October 30, 2026, that could allow an unauthenticated network attacker to execute arbitrary code under unspecified conditions; it has a CVSS v4 score of 9.5, while technical details and the affected interface have not been publicly disclosed. ClickHouse Cloud and BYOC environments have been patched, but self-managed deployments should upgrade supported release lines to 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, or 26.10.3.7-stable, while older unsupported versions have no published fix and should be treated as potentially exposed. The advisory notes that ClickHouse may be embedded in products such as Langfuse, PostHog, Opik, and Sentry, requiring organizations to inspect container images, Compose files, Helm charts, and Kubernetes manifests rather than relying solely on database inventories. Recommended actions include identifying all installations, removing public access to common ClickHouse ports, pinning fixed container versions, reviewing exposed systems for suspicious processes or outbound connections, and rotating connected service credentials if compromise is suspected. It also provides example log and cloud-security queries for locating ClickHouse instances, identifying versions and internet exposure, and conducting generic post-compromise hunting.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.