Copyright © 2012 Red Hat, Inc. All rights reserved. Critical 2026-07-29T00:00:00 ClickHouse Server: ClickHouse Server: Arbitrary code execution via SQL Injection in create dictionaries function 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-89

SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function.

A flaw was found in ClickHouse Server. A SQL Injection vulnerability exists in the `create dictionaries` function, which allows a remote attacker to execute arbitrary code. This could lead to a complete compromise of the affected system.

https://www.cve.org/CVERecord?id=CVE-2026-51992 https://nvd.nist.gov/vuln/detail/CVE-2026-51992 https://clickhouse.com/docs/sql-reference/dictionaries#postgresql https://github.com/TheLiimbo/CVE-2026-51992