- Federal: Is there a ClickHouse version that is secured for US Federal compliance?
Trust center Updates
CVE-2026-116366: Unauthenticated Remote Code Execution Vulnerability in ClickHouse
ClickHouse has identified and remediated a Critical severity vulnerability (CVE-2026-116366) that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on a ClickHouse server. The vulnerability has a CVSS v4.0 base score of 9.5 (Critical): CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.
ClickHouse Cloud and BYOC: All managed deployments, including ClickHouse Cloud and BYOC, have already been patched. We have no evidence that this vulnerability has been exploited in the ClickHouse Cloud environment. No action is required by our customers.
Open-source and self-managed deployments: The fix has been backported to all supported versions listed in security.md. Please ensure your instances are running at least one of the following minimum versions:
26.3 → 26.3.62.3-lts
26.8 → 26.8.36.3-lts
26.9 → 26.9.27.3-stable
26.10 → 26.10.3.7-stable
The versions can be found either at packages.clickhouse.com or the ClickHouse Docker registry. Further details are available in the ClickHouse security changelog. To subscribe to our embargo notification process use our Trust Center.
The pull request containing the patch will be made public after Friday, November 13, 2026.
If you have any questions or require assistance, please contact us at security@clickhouse.com.
CVE-2026-111497: Brotli Decoder Vulnerability Affecting ClickHouse Server
ClickHouse has identified and remediated a vulnerability in the Brotli decoder (CVE-2026-111497, CVSS 9.2), a third-party dependency used by ClickHouse Server. The vulnerability could allow specially crafted Brotli-compressed requests to cause ClickHouse Server crashes.
ClickHouse Cloud and BYOC: All managed deployments, including ClickHouse Cloud and BYOC, have already been patched. We have no evidence that this vulnerability has been exploited in the ClickHouse Cloud environment. No action is required by our customers.
Open-source and self-managed deployments: The fix has been backported to all supported versions listed in security.md. Please ensure your instances are running at least one of the following minimum versions:
26.3 → 26.3.62.3-lts
26.8 → 26.8.36.3-lts
26.9 → 26.9.27.3-stable
26.10 → 26.10.3.7-stable
The versions can be found either at packages.clickhouse.com or the ClickHouse Docker registry. To subscribe to our embargo notification process use our Trust Center.
If you have any questions or require assistance, please contact us at security@clickhouse.com.
ClickHouse Response to the Latest LiteLLM Supply Chain Compromise
ClickHouse is not impacted by the recent supply chain compromise affecting LiteLLM. Our security team has completed a thorough investigation and confirmed that LiteLLM is not used in our platform or its supporting infrastructure. No action is required by our customers.
ClickHouse Response to the eMudhra Intermediate Certificates Disclosure
ClickHouse is not impacted by the recently disclosed compromise of eMudhra intermediate certificates. Our security team has completed a thorough investigation and found no evidence of the affected eMudhra certificates being used in our infrastructure. ClickHouse uses Let’s Encrypt and AWS managed CA for server certificates, and DigiCert for code signing. As part of our regular container image update process, we will also update our images with the latest CA root stores. No action is required by our customers.
ClickHouse Response to the Latest PHP Vulnerabilities
ClickHouse managed versions including Cloud and BYOC are not impacted by the recently published vulnerabilities affecting PHP (CVE-2026-109618 and CVE-2026-109619). Our security team has completed a thorough investigation and confirmed that PHP is not used in our platform or its supporting infrastructure. No action is required by our customers.