Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL (https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).
Published: 2026-07-29
Score: 9.1 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

SQL injection in ClickHouse Server can be triggered via the create dictionaries function. The flaw allows a remote attacker to inject arbitrary SQL statements, leading to execution of code with the privileges of the server process. This results in full compromise of the affected system, exposing any data stored in ClickHouse.

Affected Systems

The vulnerability affects ClickHouse Server versions up to and including 26.3.9.8. Any deployment of these versions that accepts untrusted input to the create dictionaries API is susceptible. The product is broadly used for analytics and reporting, so many environments could be impacted.

Risk and Exploitability

The CVSS score of 9.1 classifies the issue as critical. However, the EPSS score indicates it is unlikely to be actively exploited at present, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over the network, where any client that can invoke the create dictionaries function may carry out the injection. No additional dependencies or privileged access are required beyond standard API access.

Generated by OpenCVE AI on August 4, 2026 at 12:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ClickHouse Server to a version newer than 26.3.9.8, which contains the fix for the injection issue.
  • If upgrading is not immediately possible, restrict network access to the create dictionaries endpoint to trusted hosts only.
  • Ensure that the account used to create dictionaries has the minimum necessary permissions and cannot run arbitrary SQL commands.

Generated by OpenCVE AI on August 4, 2026 at 12:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Description SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL (https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).

Thu, 06 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title ClickHouse Server: ClickHouse Server: Arbitrary code execution via SQL Injection in create dictionaries function
References
Metrics threat_severity

None

 threat_severity

Critical

Tue, 04 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
Title ClickHouse Server SQL Injection via Create Dictionaries Function

Sat, 01 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title ClickHouse Server SQL Injection via Create Dictionaries Function

Wed, 29 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Clickhouse
Clickhouse clickhouse
Vendors & Products Clickhouse
Clickhouse clickhouse

Wed, 29 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Description SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function.
References

Subscriptions

Clickhouse Clickhouse
cve-icon MITRE

Status: REJECTED

Assigner: mitre

Published:

Updated: 2026-08-06T08:43:08.121Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51992

cve-icon Vulnrichment

Updated: 2026-07-29T18:11:10.351Z

cve-icon NVD

Status : Rejected

Published: 2026-07-29T17:16:52.040

Modified: 2026-08-06T09:16:36.693

Link: CVE-2026-51992

cve-icon Redhat

Severity : Critical

Publid Date: 2026-07-29T00:00:00Z

Links: CVE-2026-51992 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:45:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')