581 matches found
CVE-2026-51992
CVE-2026-51992 Dans ClickHouse, il existe une fonctionnalité qui permet à un utilisateur disposant des permissions appropriées de créer des dictionnaires afin d'interagir avec différentes bases de données et d'exécuter des requêtes spécifiques sur celles-ci. Pour PostgreSQL, les requêtes SELECT...
CVE-2026-19854
When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...
EUVD-2026-67089
When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...
CVE-2026-19854
CVE-2026-19854 affects the ClickHouse plugin (Grafana) when it uses the Native protocol (the default) together with PDC or secure SOCKS . The root cause is that the underlying connection library requests TLS but then ignores it, resulting in plaintext communication with ClickHouse. Concretely, us...
CVE-2026-19854 CVE-2026-19854 CVE Record
When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...
clickhouse-datasource silently drops TLS over PDC
When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...
CVE-2026-75910
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...
CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...
CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...
EUVD-2026-63585
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...
CVE-2026-75910
The ClickHouse connector deployment template in Amazon Athena Federated Query (versions before v2026.17.1) has an incorrect privilege assignment: an authenticated remote user can point the connector's connection string at an unrelated AWS Secrets Manager secret and a database endpoint they contro...
ANT-2026-KC1Y51NF · openmeterio/openmeter · sql_injection
sql-injection medium GHSA-wc3v-3457-c8cm Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-KC1Y51NF: SQL injection in...
GO-2026-4341 vulnerabilities
Vulnerabilities for packages: kubernetes-event-exporter, ceph-csi-operator-fips, vault, nri-jmx, lazygit, mongodb-kubernetes-operator-fips, gitlab-runner-fips, maru, redpanda, lvm-driver-fips, eck-operator-fips, k6-fips, terraform-provider-sendgrid-fips, terraform-provider-acme-fips,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: helm-set-status, lazydocker, oauth2-proxy, envconsul, tkn, wire-go, glow, headlamp, kuberlr, ratify, cloud-sql-proxy, nodetaint, migrate, step-kms-plugin, controller-gen, nri-f5, terraform, ini-file, nri-redis, trivy, rabbitmq-cluster-operator, portieris, conftest,...
CVE-2026-51992
A flaw was found in ClickHouse Server. A SQL Injection vulnerability exists in the create dictionaries function, which allows a remote attacker to execute arbitrary code. This could lead to a complete compromise of the affected system...
CVE-2026-18801
OpenMeter is affected by a stored/second-order SQL injection in the handling of customer usage-attribution values. A user who can create or update a customer can store a crafted value in usageAttribution.key or usageAttribution.subjectKeys, which is later incorporated into a ClickHouse WITH map(....
CVE-2026-18801 Stored Clickhouse SQL Injection Through Customer Usage Attribution
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...
CLEANSTART-2026-QR05590 Security fixes in clickhouse-operator 0.25.5-r0
Package clickhouse-operator version 0.25.5-r0 fixes 2 vulnerabilities: CVE-2025-22868, CVE-2025-22870...
CVE-2026-51992
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code...