CVE-2026-116366: The ClickHouse RCE and the Self-Hosted Database You Forgot You Run

Public detail is deliberately thin. ClickHouse has not disclosed the specific conditions, the port or interface involved, or how the bug reaches code execution. Vulnerability trackers classify the underlying weakness as an integer overflow (CWE-190). Beyond that, any detailed account of the mechanism you read before the embargo lifts is an inference, and that should affect how much you trust it.

Exploitation status is similarly limited. ClickHouse says it has no evidence of exploitation in the ClickHouse Cloud environment, and that statement does not cover self-managed servers. The flaw was not in CISA's Known Exploited Vulnerabilities catalog as of November 4. Aggregators disagree about whether exploit code is public, one researcher has claimed remote code execution publicly without confirmation from ClickHouse, and we have not verified either. Assume capable attackers will have it soon after the patch becomes visible.

ClickHouse has listed four fixed builds for self-managed servers. Move to the fixed build on your own branch. It is the smallest change, and it avoids turning a security patch into a feature upgrade. ClickHouse names no workaround.

If you run a branch that is not listed, such as 26.4 through 26.7 or 26.2 and older, you need to move to a supported branch. Be careful with version lists on aggregator sites: the CVE record lists builds for 26.4 and 26.6 too, but those are under the ClickHouse Cloud product and are not self-managed releases. Altinity has its own builds and said on November 2 that its fix for this CVE was a few days away, so check its advisory if you use them.

Start by finding every instance. Search your Compose files, Helm charts, and infrastructure code for clickhouse, including inside the third-party tools you self-host. Then test from outside your network, not from the machine itself. A database that answers from localhost tells you very little.

A common failure with containers is worth checking directly. On a typical Linux host, a port published by Docker can bypass ufw rules, because Docker manages its own firewall chains. A server can show a tidy firewall configuration and still accept connections on the database port from anywhere. Generated Compose files often publish ports because that makes local development easy, and those settings tend to survive into production.

Since ClickHouse has not named the interface, treat every listener as in scope. Restricting network access to the hosts that need it is sensible on its own merits, and it reduces who can reach the flaw. It does not replace the upgrade.

The same four builds also address CVE-2026-111497, a buffer overflow in Google's Brotli decoder rated 9.2. ClickHouse describes the effect on its server as crashes from crafted Brotli-compressed requests, and Altinity says the issue affects ClickHouse versions from 19.3.3 onward. The upstream CVE record is broader, covering Brotli generally and listing memory disclosure and potential code execution among possible impacts.

CISA added the Brotli flaw to its exploited list on October 27. That entry is about Brotli itself, and it does not establish that ClickHouse servers specifically are being attacked. It does show how far a single compression library can travel: Brotli sits inside many products that have no obvious connection to it. Check it across your stack as well, because a dependency of this kind will not show up in your own package.json if it is compiled into something else.

ClickHouse is excellent software, and this article is no argument against it. It has become a popular choice for AI products in particular, because storing prompts, responses, traces, and usage events calls for an analytics database. Coding assistants and quick-start templates make it easy to add. A coding agent asked to add LLM analytics can stand up a working ClickHouse container in minutes.

What the quick start does not hand you is ownership of a database. That database may well be holding your customers' prompts, and those prompts may contain more sensitive information than your primary tables. Each self-hosted component is another thing that needs an inventory entry, network rules, backups, upgrades, and somebody reading its advisories. Managed offerings exist largely to take that off your plate, and this CVE is a clean example: Cloud customers had nothing to do.

If you are earning revenue on a stack like this, the useful question is whether you should be running that component at all, and if so, who is responsible for it. An experienced engineer can answer that quickly and either move it to a managed service or put real operations around it. If you would like help, we review this kind of setup as part of productionizing AI-built applications, and we can stay on through a retainer.