Dear Altinity customers and ClickHouse users,
This is an update regarding CVE-2026-116366, a security vulnerability that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on a ClickHouse server.
Additional technical details remain under embargo until November 13, 2026. Although exploitation requires specific conditions, we recommend upgrading to a patched version as soon as possible to keep your ClickHouse installations secure.
The vulnerability has been patched in the following Altinity builds:
- 24.3.18.10428.altinitystable
- 24.8.14.10551.altinitystable
- 25.3.14.10003.altinitystable
- 25.8.33.10003.altinitystable
- 25.8.33.20004.altinityantalya
- 26.3.60.10002.altinitystable
- 26.3.60.20002.altinityantalya
Debian and RPM packages are available at builds.altinity.cloud, and container images are available on Docker Hub.
Patches for additional Altinity builds are in preparation. We expect further updates early next week.
For users running upstream ClickHouse, patched Docker images are also available, although the corresponding releases have not yet been officially published:
- 26.3.62.3
- 26.8.36.3
- 26.9.27.3
- 26.10.3.7
If you are running a ClickHouse version that is not listed above, please upgrade to one of the patched Altinity builds or upstream ClickHouse releases to address this vulnerability.
We would like to thank the ClickHouse, Inc. security team for their cooperation and for sharing the security fixes, helping us keep the ClickHouse community secure.
Join our Slack
ClickHouse is a registered trademark of ClickHouse, Inc.; Altinity is not affiliated with or associated with ClickHouse, Inc.
Get the latest ClickHouse news straight to your inbox every month.
