ClickHouse says in its security changelog that an issue discovered in ClickHouse Server could, under certain conditions, allow an unauthenticated user with network access to execute arbitrary code on the server.

It lists the fix under 'Fixed in ClickHouse v26.10.3.7, 2026-10-30' and says the fix has been pushed to the open-source versions v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable, and that a fix has been applied to all ClickHouse Cloud and BYOC deployments; it credits Elshad Toklayev.

ClickHouse, as the CVE Numbering Authority, published CVE-2026-116366 on 30 October 2026 (11:00 UTC; 7:00 pm Perth) under the title 'Unauthenticated RCE vulnerability against ClickHouse Server', classed as CWE-190 (integer overflow or wraparound), with a CVSS 4.0 base score of 9.5 (Critical; network attack vector, high attack complexity, no privileges or user interaction). The CVE record lists open-source ClickHouse 26.3 before 26.3.62.3-lts, 26.8 before 26.8.36.3-lts, 26.9 before 26.9.27.3-stable and 26.10 before 26.10.3.7-stable as affected, and also lists ClickHouse Cloud builds before 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597 and 26.10.2.84.

Neither ClickHouse's changelog nor the CVE record describes the conditions needed or reports exploitation. (source: ClickHouse security changelog; CVE record)