CVE-2026-51992
Low risk· EPSS 41%Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL.
Risk Assessment
There is no risk associated with this CVE as it has been rejected. It is not a vulnerability in ClickHouse, but a misinterpretation of a PostgreSQL feature.
Recommendation
No action is required as the CVE has been rejected. However, ensure that users have appropriate permissions and that access to PostgreSQL is controlled.
Other vulnerabilities in ClickHouse
Original NVD description (English source)
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL (https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS