CVE-2026-93404

A flaw was found in rsyslog. The built-in ClickHouse output templates fail to properly escape backslash characters when formatting Structured Query Language SQL queries. An attacker capable of submitting crafted log messages routed to an affected ClickHouse action can exploit this issue to alter...

EUVD-2026-124058

ClickMigrate is a database migration tool for ClickHouse with automatic SQL migration management and version tracking. Prior to version 1.0.3, a path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations...

CVE-2026-51992

CVE-2026-51992 Within ClickHouse, a feature exists that allows a user with the correct permissions to create dictionaries in order to interact with different databases and run specific queries on them. For PostgreSQL, SELECT queries are wrapped in a COPY QUERY TO STDOUT statement before being...

ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write

ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access. id: CVE-2026-116366 info: name: ClickHouse Server - Brotli v1.2.0 Decoder...

Exploit for CVE-2026-116366

CVE-2026-116366 — ClickHouse Server Unauthenticated RCE Brotl...

CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

ClickHouse Server 26.10.2.103 Brotli Decoder out of Bounds Write

ClickHouse Server version 26.10.2.103 contains an unauthenticated out-of-bounds write in its bundled Brotli decoder that can permit arbitrary code execution under certain conditions. The proof of concept detects vulnerable servers and demonstrates denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-116366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary...

CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

CVE-2026-116366 Unauthenticated RCE vulnerability against ClickHouse Server

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

CVE-2026-116366 Unauthenticated RCE vulnerability against ClickHouse Server

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

CVE-2026-116366

A vulnerability in ClickHouse Server allows an unauthenticated user with network access to execute arbitrary code on the server under certain conditions. This issue is associated with CWE-190 (Integer Overflow or Wraparound) and has a CVSS v4.0 base score of 9.5 (CRITICAL) . Fixes have been relea...

EUVD-2026-113778

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server. Fix has been pushed to the following open-source versions: v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stabl...

CVE-2026-116366: ClickHouse: An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user…

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server...

EUVD-2026-110523

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events.name values to the chart.sankey...

EUVD-2026-110521

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDa...

EUVD-2026-110520

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into...

EUVD-2026-110525

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count...