CVE-2024-23689

HighCVSS 8.8

Published: 19/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.67%

48th percentile - higher than 48% of all known CVEs

Summary

A vulnerability in ClickHouse libraries (clickhouse-r2dbc, clickhouse-jdbc, clickhouse-client) prior to version 0.4.6 exposes sensitive information in exceptions. When 'sslkey' is specified and an exception (e.g., ClickHouseException or SQLException) occurs, the client certificate password is included in the error message, allowing unauthorized users to capture it.

Risk Assessment

The risk involves leakage of the client certificate password into error logs, potentially enabling an attacker to access resources protected by that certificate, including ClickHouse databases.

Recommendation

Immediately update clickhouse-r2dbc, clickhouse-jdbc, and clickhouse-client libraries to version 0.4.6 or later. Additionally, review logs for password leakage and rotate affected passwords.

Other vulnerabilities in ClickHouse

CVE-2026-51992Low risk· EPSS 41%
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL.

Original NVD description (English source)

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS