CVE-2026-116366

What ClickHouse says. The security changelog entry, under "Fixed in ClickHouse v26.10.3.7, 2026-10-30," says "An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server." Fixed open-source versions are v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. ClickHouse credits Elshad Toklayev. NVD shows ClickHouse's 9.5 (CVSS 4.0, attack complexity high) and CWE-190, with no NVD score of its own.

What the PoC author says. The googlesky/CVE-2026-116366 repository, created October 31, says the bug is in ClickHouse's bundled Brotli 1.2.0 decoder, fixed in Brotli 1.2.1, and shares its root cause with CVE-2026-111497. It says the path is a POST to the HTTP interface with a Content-Encoding: br body, and that the attack is unauthenticated where the default user has an empty password and the server listens beyond localhost. Its tests show a permanent CPU spin and about 60 MB of memory growth per request. It says turning that into code execution "is heap-layout dependent" and does not demonstrate it. ClickHouse has not confirmed any of this. The repository's own description says "unauthenticated RCE"; its README doesn't show that.

Not to be confused with. CVE-2026-111497, the Brotli decoder bug already on this page and on CISA KEV since October 27. If the PoC author is right, the two share a root cause, but ClickHouse fixed CVE-2026-116366 in its own releases, and those are what close it.

The test. One condition decides exposure, the version. The rest ranks which servers go first.

1. Is the server below the fixed version for its branch? Run SELECT version() on each self-hosted server and compare it to v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable or v26.10.3.7-stable for that branch. Below it, the server is in scope. ClickHouse lists fixes only for the 26.3, 26.8, 26.9 and 26.10 lines and doesn't say whether older lines are affected.
2. Who can reach the HTTP interface? ClickHouse documents port 8123 for HTTP and 8443 for HTTPS. Servers whose HTTP ports answer from the internet or other untrusted networks go first.
3. Does the default user have a password? ClickHouse's HTTP documentation says that if no user name is given, "the default name is used," and if no password is given, "an empty password is used." The PoC author says an empty default password is what makes the attack unauthenticated. Check the server's user configuration.

ClickHouse publishes no mitigation for CVE-2026-116366; its remedy is the update. The first two lines come from ClickHouse's general configuration documentation, not from guidance for this CVE. The third comes from the PoC author. Each works only under the condition at the end of it.

• Delivery. Limit where each user can connect from with user_name/networks, which ClickHouse's user settings documentation describes as the "List of networks from which the user can connect to the ClickHouse server." This only helps if a connection from outside the allowed range is refused when you test it.
• Delivery. Set a password on the default user, since ClickHouse's HTTP documentation says a request with no credentials uses default with an empty password. ClickHouse's docs recommend password_sha256_hex over a plaintext password. This only helps if an unauthenticated request to port 8123 or 8443 is rejected when you test it.
• Delivery. Reject Content-Encoding: br request bodies at a reverse proxy in front of ClickHouse, which the PoC author suggests. ClickHouse's documentation lists br among the compression methods it accepts on POST bodies. This only helps if no client relies on Brotli-compressed requests and every route to the HTTP interface goes through the proxy.

Updating to the fixed version for your branch is the only fix.

ClickHouse has published no indicators. These come from the PoC author's README and describe its denial-of-service behavior, not observed attacks.

• POST requests to the HTTP interface with Content-Encoding: br, which the PoC author pairs with a max_query_size=20000000 query parameter.
• A ClickHouse server process stuck at full CPU, or memory growing by tens of megabytes per request, after such requests.

Am I exposed to CVE-2026-116366?

Yes, if you run a self-hosted ClickHouse Server below v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable or v26.10.3.7-stable on its branch. ClickHouse says Cloud and BYOC deployments already have the fix.

Is CVE-2026-116366 being exploited?

No exploitation has been reported, and it is not on CISA KEV as of November 3, 2026. Public code detects the bug and makes servers hang; by its own README it does not run code.

Is this the same as the Brotli vulnerability, CVE-2026-111497?

ClickHouse doesn't say. Its changelog doesn't mention Brotli. The PoC author says CVE-2026-116366 has the same root cause in the Brotli decoder ClickHouse bundles. Either way, ClickHouse's own fixed release is what closes CVE-2026-116366.

How do I mitigate CVE-2026-116366 without patching?

ClickHouse hasn't published a mitigation for this CVE. Its general docs support limiting which networks each user can connect from and setting a password on the default user, and the PoC author suggests rejecting Brotli-compressed request bodies at a proxy. Test each change, then update.

Nov 3, 2026. First published. ClickHouse fix Oct 30; public detection and denial-of-service code since Oct 31; no exploitation reported; not on CISA KEV.

• ClickHouse security changelog, CVE-2026-116366 (Oct 30, 2026)
• NIST NVD: CVE-2026-116366 (Awaiting Analysis; ClickHouse's 9.5 only, checked Nov 3)
• ClickHouse HTTP interface documentation and user settings documentation
• googlesky/CVE-2026-116366 (PoC author's analysis; read only, not run)
• CISA Known Exploited Vulnerabilities catalog (checked Nov 3)