---
title: ClickHouse fixes CVE-2026-116366 (CVSS 4.0 9.5): an unauthenticated user with network access could run code on ClickHouse Server under certain conditions | ctxsec
url: https://ctxsec.com/items/clickhouse-cve-2026-116366-unauthenticated-rce-fixed-26-10-3-7
description: ""
status: "official (ClickHouse security changelog, Oct 30); no exploitation reported"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/clickhouse-cve-2026-116366-unauthenticated-rce-fixed-26-10-3-7.md)

official (ClickHouse security changelog, Oct 30); no exploitation reported

2026-10-30

### ClickHouse fixes CVE-2026-116366 (CVSS 4.0 9.5): an unauthenticated user with network access could run code on ClickHouse Server under certain conditions

ClickHouse says an issue in ClickHouse Server could, under certain conditions, let an **unauthenticated** user with network access execute arbitrary code. Details of the conditions are not published. The CVSS 4.0 score is 9.5 with high attack complexity.

- **Fixed in:** v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable.
- **Cloud:** ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments.
- **Exploitation:** none reported.

**Do now:** upgrade self-managed servers, and make sure the native and HTTP ports are not reachable from the internet or untrusted networks.

Sources: [ClickHouse security changelog: CVE-2026-116366 (fixed Oct 30)](https://clickhouse.com/docs/resources/changelogs/security-changelog) · [NVD: CVE-2026-116366](https://nvd.nist.gov/vuln/detail/CVE-2026-116366)