SZB-84e3322280
ClickHouse Server flaw (EUVD-2026-113778) could allow unauthenticated code execution
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ClickHouse
- Product
- ClickHouse Server
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-113778, scored 9.5 under CVSS v3.1, describes an issue in ClickHouse Server. Under certain conditions it could let an unauthenticated network user execute arbitrary code on the server.
If you use ClickHouse
Upgrade ClickHouse Server to a fixed version listed in the vendor advisory
Restrict network access to ClickHouse ports to trusted hosts only
Audit servers for unexpected processes, files, or accounts
Check EUVD-2026-113778 for the affected version range
What the sources say 1
· Mastodon: “An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.” Source