CVE-2026-51992

CriticalCVSS 9.1

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

41th percentile - higher than 41% of all known CVEs

Summary

SQL Injection vulnerability in ClickHouse Server versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function.

Risk Assessment

An attacker can remotely execute arbitrary SQL code, potentially leading to full compromise of the database and system.

Recommendation

Upgrade ClickHouse Server to a version later than 26.3.9.8 that includes a fix for this vulnerability.

Original NVD description (English source)

SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function.