ClickHouse Server CVE-2026-116366

The CVE description states exploitation is possible only 'under certain conditions' but does not name the specific feature, protocol endpoint, configuration setting, or deployment mode that constitutes those conditions - the trigger is not described in the available sources. Confirmed prerequisites from the CVSS 4.0 vector: network reachability of the ClickHouse Server (AV:N) and no authentication (PR:N) and no user interaction (UI:N). The principal limiting factor is AC:H, indicating the attacker cannot succeed against every instance on demand; combined with the 'certain conditions' qualifier, this implies a non-default or situational prerequisite that the provided sources do not enumerate. Defenders should restrict network exposure of the ClickHouse Server interface and consult the vendor security changelog for the specific affected configurations and fixed version, which are not given in this input.

This is a genuine high-priority issue, not a high-CVSS/low-real-risk case. The CVSS 4.0 vector (AV:N, PR:N, UI:N) describes a network-reachable, unauthenticated vulnerability leading to arbitrary code execution, and the vuln.today Decision label is act_now, which signals urgency. The chief tension in the signals is AC:H combined with the description's qualifier 'under certain conditions' - meaning exploitation is not a trivial one-shot against any default instance, but depends on conditions the available sources do not enumerate. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no proof-of-concept or exploit reference is present in the input, so there is no public exploit identified at time of analysis. The CWE-190 (integer overflow) classification plus the RCE outcome is consistent with a memory-safety flaw reachable over ClickHouse's network interface, but how the overflow is reached and what the 'certain conditions' are is not described in the available sources. Bottom line: unauthenticated network RCE in a widely used database warrants prompt patching per the act_now label, with the AC:H and conditional qualifier tempering the likelihood of indiscriminate mass exploitation relative to a clean AV:N/AC:L flaw.

An unauthenticated attacker with network access to a ClickHouse Server's exposed interface sends specially crafted input that triggers an integer overflow (CWE-190) in server-side processing, leading to arbitrary code execution on the host. The specific trigger and the 'certain conditions' required are not described in the available sources, and the AC:H rating indicates the attack is not reliably reproducible against every configuration. No public exploit code has been identified at time of analysis.