ClickHouse patches a critical flaw that could let unauthenticated users run code on the server

ClickHouse, the column-store database behind many analytics and LLM observability tools, has fixed a critical vulnerability. Its security changelog says CVE-2026-116366 “under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.”

The facts so far

• Fixed versions: v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. Docker Hub has images for all four.
• ClickHouse Cloud and BYOC deployments are already patched, per the vendor.
• Severity: NVD published the CVE on 30 October with a CVSS 4.0 score of 9.5 (critical): network attack, no privileges or user interaction needed, but high attack complexity. CISA’s SSVC entry, as shown on NVD, records no known exploitation, not automatable, and total technical impact.
• Weakness: the GitHub advisory classes it as an integer overflow (CWE-190).
• Credit: Elshad Toklayev.

ClickHouse has not said which older versions are affected or published technical details. Its changelog lists only fixed releases, so do not assume a version outside that list is safe. The researcher has described the bug on X; those are his claims, not the vendor’s.

AI stacks that bundle ClickHouse

Self-hosted LLM observability is a common way ClickHouse ends up on a developer’s machine. Langfuse, the open-source tracing platform, changed its docker-compose.yml on 30 October from the floating clickhouse/clickhouse-server:25.12 tag to the fixed 26.3.62.3-lts in commit 850e9f38. If you run Langfuse from an older checkout, pull and recreate the ClickHouse container. Other tools that ship ClickHouse in a compose file deserve the same check.

What to do

1. Find every ClickHouse server you run, including ones inside compose stacks and Helm charts.
2. Upgrade to the fixed release in your line, or move to one of the four lines above.
3. Check that the native and HTTP ports (9000 and 8123 by default) are not reachable from the internet, and that the default user has a password. Restricting network access does not fix the bug, but it limits who can try it.

Cloud users get the fix without doing anything, as they did with the executable UDFs that reached general availability in ClickHouse Cloud this month. For another tool in the same AI plumbing that needed urgent updates, see the LiteLLM credential stealer.

Why this matters

NVD rates the flaw 9.5 and it needs no login, only network access to the server. ClickHouse now sits inside many self-hosted AI tools, which means some teams run it without thinking of it as a database they must patch. Cloud users are covered, so the work falls on anyone self-hosting, including through Langfuse and similar compose files.