CVE-2026-51992
ClickHouse Server versions up to 26.3.9.8 contain a SQL injection flaw that allows a remote attacker to execute arbitrary code by using the create dictionaries function. The flaw can be exploited without authentication or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
ClickHouse Server versions 26.3.9.8 and earlier, typically used by database administrators and developers.
Real-world impact
An attacker could run any code on the affected server, potentially taking full control of the database system.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is remotely exploitable with no authentication, can lead to complete compromise, and has a high impact on confidentiality and integrity. The lack of required privileges and the ability to execute arbitrary code make it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources