{"type":"bundle","id":"bundle--2afda7cf-4211-55f8-9d88-40a81938e29f","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--66f71312-794b-5eb8-92ad-66d0417726e7","created":"2026-10-30T11:59:06.793Z","modified":"2026-10-30T11:59:06.793Z","name":"ClickHouse Server unauthenticated RCE (CVE-2026-116366): self-hosted servers reachable on the network can be taken over without a password","description":"On 2026-10-30 ClickHouse disclosed CVE-2026-116366: under certain conditions, an unauthenticated user with network access can execute arbitrary code on ClickHouse Server. The ClickHouse CNA rates it CVSS 4.0 9.5 (AV:N/AC:H/PR:N/UI:N), classifies it as CWE-190 integer overflow, and credits Elshad Toklayev. Fixed open-source builds are 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable. ClickHouse says the fix is applied to all ClickHouse Cloud and BYOC deployments. ClickHouse has not named the affected interface, the conditions, or published a proof of concept. Unsupported trains (26.7, 26.4 to 26.6, 26.1, 26.2, 25.x and older) receive no fix. Langfuse and SigNoz self-host defaults bundle ClickHouse 25.12 and 25.5.6 images, which are off support.","aliases":["CVE-2026-116366","ClickHouse unauthenticated RCE","ClickHouse Server integer overflow RCE","ClickHouse 26.8.36.3 security fix"],"first_seen":"2026-10-30T10:59:00Z","last_seen":"2026-10-30T11:51:55Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"ClickHouse security changelog: CVE-2026-116366","url":"https://clickhouse.com/docs/resources/changelogs/security-changelog"},{"source_name":"CVE-2026-116366 CVE record (ClickHouse CNA)","url":"https://www.cve.org/CVERecord?id=CVE-2026-116366"},{"source_name":"ClickHouse SECURITY.md supported versions","url":"https://github.com/ClickHouse/ClickHouse/blob/master/SECURITY.md"},{"source_name":"Docker Hub clickhouse/clickhouse-server tags","url":"https://hub.docker.com/r/clickhouse/clickhouse-server/tags"},{"source_name":"Langfuse docker-compose.yml (ClickHouse 25.12 image)","url":"https://github.com/langfuse/langfuse/blob/main/docker-compose.yml"},{"source_name":"SigNoz Docker install docs (ClickHouse 25.5.6 image)","url":"https://signoz.io/docs/install/docker/"},{"source_name":"HOL: ClickHouse CVE-2026-116366 unauthenticated RCE, what to upgrade","url":"https://hol.org/blog/cve-2026-116366-clickhouse-unauthenticated-rce-upgrade"}]}]}