airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2022-38649 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2022-38649...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2022-40189 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2022-40189...

CVE-2026-57955: Improper Neutralization of Special Elements used in an SQL Command

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

PT-2026-53673

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

GO-2026-5283 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource in github.com/aiven/aiven-operator

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource in github.com/aiven/aiven-operator...

AWS VDP: AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF

Vulnerability description not provided...

MAL-2026-5942 Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

OpenMeter: SQL injection through meter creation

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

GHSA-WC3V-3457-C8CM OpenMeter: SQL injection through meter creation

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

PT-2026-46869

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

PT-2026-46897

Name of the Vulnerable Software and Affected Versions OpenMeter affected versions not specified Description An authenticated tenant can perform SQL injection through the valueProperty or groupBy fields of the 'POST /api/v1/meters' endpoint. The issue occurs because the application uses string...

airflow-add-ons (0.2.9b1), airflow-clickhouse-plugin (0.8.2) +1 more potentially affected by CVE-2026-46764 via apache-airflow (2.3.4)

apache-airflow PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-add-ons 0.2.9b1 - airflow-clickhouse-plugin 0.8.2 - armada-airflow =0.1.0, =0.2.0 Source cves: CVE-2026-46764 Source advisor...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2026-46764 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2026-46764...

airflow-clickhouse-plugin (1.2.0), airflow-tools (>=0.8.5, <=0.9.1) +2 more potentially affected by CVE-2026-48726 via apache-airflow (2.8.4)

apache-airflow PYPI version 2.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.2.0 - airflow-tools =0.8.5, =0.0.4, =2.4.0rc1, =2.5.1 Source cves: CVE-2026-48726 Source advisory:...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2026-48726 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2026-48726...

acryl-datahub-airflow-plugin (>=0.10.5.2rc3, <=0.11.0), airflow-clickhouse-plugin (>=0.11.0, <=1.0.0.post0) potentially affected by CVE-2026-48726 via apache-airflow (2.6.3)

apache-airflow PYPI version 2.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - acryl-datahub-airflow-plugin =0.10.5.2rc3, =0.11.0, =1.0.0.post0 Source cves: CVE-2026-48726 Source advisory: OSV:GHSA-VR7M-C6V4-8CX...

airflow-clickhouse-plugin (0.6.0), dataverk-airflow (>=0.3.18, <=0.3.23) +1 more potentially affected by CVE-2026-48726 via apache-airflow (2.0.2)

apache-airflow PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 0.6.0 - dataverk-airflow =0.3.18, =11.8.0, =13.7.0 Source cves: CVE-2026-48726 Source advisory:...

airflow-add-ons (0.2.9b1), airflow-clickhouse-plugin (0.8.2) +1 more potentially affected by CVE-2026-48726 via apache-airflow (2.3.4)

apache-airflow PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-add-ons 0.2.9b1 - airflow-clickhouse-plugin 0.8.2 - armada-airflow =0.1.0, =0.2.0 Source cves: CVE-2026-48726 Source advisor...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-48726 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-48726 Source advisory:...