[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (ClickHouse security changelog, Oct 30); no exploitation reported

ClickHouse fixes CVE-2026-116366 (CVSS 4.0 9.5): an unauthenticated user with network access could run code on ClickHouse Server under certain conditions

ClickHouse says an issue in ClickHouse Server could, under certain conditions, let an unauthenticated user with network access execute arbitrary code. Details of the conditions are not published. The CVSS 4.0 score is 9.5 with high attack complexity.

  • Fixed in: v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable.
  • Cloud: ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments.
  • Exploitation: none reported.

Do now: upgrade self-managed servers, and make sure the native and HTTP ports are not reachable from the internet or untrusted networks.

Sources: ClickHouse security changelog: CVE-2026-116366 (fixed Oct 30) · NVD: CVE-2026-116366