Critical ClickHouse vulnerability CVE-2026-116366: what to do now

On 30 October 2026, ClickHouse released fixes for CVE-2026-116366, a critical vulnerability in ClickHouse Server. According to the ClickHouse advisory, it can let “an unauthenticated user with network access” run arbitrary code on the server under certain conditions. If you run ClickHouse yourself, or a tool that brings ClickHouse along, upgrade it this week.

What we know about CVE-2026-116366

ClickHouse gives the flaw a CVSS v4.0 score of 9.5 (Critical). The vector says no login and no user action are needed (PR:N/UI:N). It also rates the attack complexity as high (AC:H), which fits the “under certain conditions” in the advisory.

Much is still unknown. The advisory doesn’t say which interface or port is involved, or which conditions an attacker needs. ClickHouse will make the patch public after 13 November 2026, so expect more detail then. The vulnerability tracker Strix lists it as an integer overflow (CWE-190), but ClickHouse itself hasn’t said so.

On exploitation: ClickHouse has “no evidence” of exploitation in ClickHouse Cloud. It says nothing about self-hosted servers. On 30 October the flaw wasn’t in CISA’s catalogue of known exploited vulnerabilities. That can change once the patch is public and people can study it.

Which versions are fixed

ClickHouse Cloud and BYOC deployments are already patched. You don’t need to do anything there.

For self-hosted servers, the security changelog lists these fixed open-source versions:

Release line	Fixed in
26.3 (LTS)	26.3.62.3-lts
26.8 (LTS)	26.8.36.3-lts
26.9	26.9.27.3-stable
26.10	26.10.3.7-stable

Running an older line, such as 25.x or 24.x? The fix went to supported versions only, and the advisory doesn’t say whether older lines are affected. Don’t wait for an answer. Move to one of the lines above.

You may run ClickHouse without knowing it

ClickHouse often comes bundled with another tool, so it isn’t always on your list of databases. Two common examples:

• Langfuse, the open-source platform for LLM tracing and evaluation. Its self-hosted setup stores traces in ClickHouse. On 30 October, Langfuse moved its Docker Compose file from ClickHouse 25.12 to 26.3.62.3-lts. If you installed Langfuse with an older copy of that file, you’re still on 25.12.
• Plausible Community Edition, the privacy-friendly web analytics tool, stores its events in ClickHouse. Its compose file uses the image clickhouse/clickhouse-server:24.12-alpine.

The same goes for other observability and analytics tools. Check the compose files and Helm charts on your servers for clickhouse.

Is your ClickHouse reachable from the network?

The advisory requires network access, so exposure matters. ClickHouse listens by default on port 8123 for HTTP and port 9000 for its native protocol, and on 8443 and 9440 with TLS.

The good news: the default setups of Langfuse and Plausible don’t publish those ports to the internet. Langfuse binds them to 127.0.0.1, and Plausible doesn’t publish them at all. Trouble starts when someone opens them later “just for a quick look” with a BI tool, or runs ClickHouse on a cloud VM with an open security group.

What to do now

1. Make a list. Search your servers, compose files and Helm charts for clickhouse, including the ones inside other tools.
2. Check the version. Run SELECT version() in the ClickHouse client, or look at the image tag of the container.
3. Upgrade to one of the fixed versions in the table. For Langfuse, take the current compose file or set the ClickHouse image to 26.3.62.3-lts or newer.
4. Close the ports. Make sure 8123, 9000, 8443 and 9440 can’t be reached from the internet. Only the application that uses ClickHouse needs access. Test this from outside, for example with nc -vz <ip> 9000 from another network.
5. Pin the version. Use an exact image tag, so you know what runs and can tell quickly next time whether you’re affected.
6. Watch for the details. After 13 November, check the security changelog and the ClickHouse GitHub advisories again. If it turns out an attack leaves traces, go through your logs.