{"metadata": {"vulnerability": "CVE-2026-116366", "count": 26, "kinds": {"milestone": 4, "sighting": 13, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-26T07:54:23.069Z", "date_only": false, "value": "2026-10-26T07:54:23.069Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-116366", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T10:59:00Z", "date_only": false, "value": "2026-10-30T10:59:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / ClickHouse", "record": "CVE-2026-116366", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T11:00:11.115Z", "date_only": false, "value": "2026-10-30T11:00:11.115Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-116366", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T11:07:14.192Z", "date_only": false, "value": "2026-10-30T11:07:14.192537Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117529538312222392", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "b98a9255-7c86-4f1a-bcef-486495ba683d", "content": "CVE-2026-116366 Unauthenticated RCE vulnerability against ClickHouse Server An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.\nhttps://www.cve.org/CVERecord?id=CVE-2026-116366https://github.com/ClickHouse/ClickHouse/blob/master/SECURITY.mdhttps://clickhouse.com/docs/resources/changelogs/security-changelog#clickhouse #ClickHouse#CVE_2026_116366#bot", "url": "https://infosec.exchange/users/cve/statuses/117529538312222392"}, {"timestamp": "2026-10-30T11:17:32Z", "date_only": false, "value": "2026-10-30T11:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QHGW-GHP3-XH36", "record": "GHSA-QHGW-GHP3-XH36", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-30T11:17:32.540Z", "date_only": false, "value": "2026-10-30T11:17:32.540", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116366", "record": "FKIE_CVE-2026-116366", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T12:00:06.410Z", "date_only": false, "value": "2026-10-30T12:00:06.410684Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz3q6qvzei2n", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "02279421-7d0e-45cd-a6e1-464db36e43a0", "content": "CVE-2026-116366 - clickhouse\nClickHouse Server can be accessed over the network by someone without any login, and under certain conditions they could make the server run any commands they choose. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#clickhouse #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz3q6qvzei2n"}, {"timestamp": "2026-10-30T12:07:22.410Z", "date_only": false, "value": "2026-10-30T12:07:22.410190Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz3qlrbpy62p", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "d7d6a220-aca3-42e0-b19a-14aba6b3a3ff", "content": "\ud83d\udea8 CVE-2026-116366 \u2014 CVSS 9.5 CRITICAL\n\nAn issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenti...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-116366\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz3qlrbpy62p"}, {"timestamp": "2026-10-30T12:31:14Z", "date_only": false, "value": "2026-10-30T12:31:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QHGW-GHP3-XH36", "record": "GHSA-QHGW-GHP3-XH36", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T12:31:14Z", "date_only": false, "value": "2026-10-30T12:31:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QHGW-GHP3-XH36", "record": "GHSA-QHGW-GHP3-XH36", "field": "modified"}, {"timestamp": "2026-10-30T14:57:49.817Z", "date_only": false, "value": "2026-10-30T14:57:49.817Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ClickHouse", "record": "CVE-2026-116366", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T15:00:13Z", "date_only": false, "value": "2026-10-30T15:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MfgnlkX-tQRfk7I4H0OQAxCbbpnzSQiiY4BT28yO-PM7BDA", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "89c53237-2033-49d0-a38e-801e3096ef8a", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T15:00:13Z", "date_only": false, "value": "2026-10-30T15:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/MfgnlkX-tQRfk7I4H0OQAxCbbpnzSQiiY4BT28yO-PM7BDA", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "fa208e79-8c63-47de-871e-7602beb6a9c1"}, {"timestamp": "2026-10-30T16:31:06.488Z", "date_only": false, "value": "2026-10-30T16:31:06.488193Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/7um6o45t26plu", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "6ead2d42-bb33-463c-804b-7ba907397919", "content": "\ud83d\udea8 CVE-2026-116366\nAffected product: see description\nCVSS 9.5 / KEV: No\nTL;DR: An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access t\u2026\nhttps://cvesentinel.com/report/CVE-2026-116366\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/7um6o45t26plu"}, {"timestamp": "2026-10-30T16:36:22.337Z", "date_only": false, "value": "2026-10-30T16:36:22.337339Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-116366", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-30T16:36:22.337Z", "date_only": false, "value": "2026-10-30T16:36:22.337339Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116366", "record": "FKIE_CVE-2026-116366", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-30T16:36:32.335Z", "date_only": false, "value": "2026-10-30T16:36:32.335Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-116366", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T16:36:32.335Z", "date_only": false, "value": "2026-10-30T16:36:32.335Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-116366", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T19:37:07.073Z", "date_only": false, "value": "2026-10-30T19:37:07.073", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-116366", "record": "FKIE_CVE-2026-116366", "field": "lastModified"}, {"timestamp": "2026-10-31T07:00:07Z", "date_only": false, "value": "2026-10-31T07:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108282", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "d9fd708f-839f-49f1-9f01-a8c5876bdc4a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-116366\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a googlesky\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-31 06:37:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-116366 \u2014 ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108282", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-31T11:00:15Z", "date_only": false, "value": "2026-10-31T11:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/VTEAWXPGy12wOHeRglOdS8-42y6OsgFmJv9na7rMdIh2t-o", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "e41b4de9-02f7-469e-8844-b80ef18e8351", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-31T11:00:15Z", "date_only": false, "value": "2026-10-31T11:00:15.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/VTEAWXPGy12wOHeRglOdS8-42y6OsgFmJv9na7rMdIh2t-o", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "7ae4562e-9a51-4774-9d76-6527f2974cd8"}, {"timestamp": "2026-10-31T15:00:07Z", "date_only": false, "value": "2026-10-31T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WZXfPr-5FUcJ2FInGQIT5w4lnJOl66L6rst2LZZ_sdGcuS0", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "f1a7f278-3005-49c2-b203-cad8be87e614", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-31T15:00:07Z", "date_only": false, "value": "2026-10-31T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/WZXfPr-5FUcJ2FInGQIT5w4lnJOl66L6rst2LZZ_sdGcuS0", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "70b44b2e-56f2-46b9-a070-1c40411207c6"}, {"timestamp": "2026-11-02T04:18:01Z", "date_only": false, "value": "2026-11-02T04:18:01.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-116366.yaml", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "4a96796a-fd5b-4dc7-a384-cfb0c4e399c9", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-116366.yaml"}, {"timestamp": "2026-11-02T05:23:09.874Z", "date_only": false, "value": "2026-11-02T05:23:09.874106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mzclfq5esw2g", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "e8f3497e-8538-4724-8af1-59e154b81cf8", "content": "The latest update for #Coralogix includes \"Threat Advisory \u2013 ClickHouse CVE-2026-116366: Unauthenticated Remote Code Execution\" and \"The Security Trifecta: Operationalizing API Protection with #AWS, Wallarm, and Coralogix\".\n \n#cybersecurity #monitoring #logging #devops https://opsmtrs.com/3JXoJPm", "url": "https://bsky.app/profile/opsmatters.com/post/3mzclfq5esw2g"}], "metrics": {"as_of": "2026-11-03T02:28:24.969Z", "anchors": {"origin": {"timestamp": "2026-10-30T10:59:00Z", "date_only": false, "value": "2026-10-30T10:59:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / ClickHouse", "record": "CVE-2026-116366", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T10:59:00Z", "date_only": false, "value": "2026-10-30T10:59:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / ClickHouse", "record": "CVE-2026-116366", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-30T15:00:13Z", "date_only": false, "value": "2026-10-30T15:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MfgnlkX-tQRfk7I4H0OQAxCbbpnzSQiiY4BT28yO-PM7BDA", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "89c53237-2033-49d0-a38e-801e3096ef8a", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 14473.0, "hours": 4.020277777777777, "days": 0.16751157407407408, "min_seconds": 14473.0, "max_seconds": 14473.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T10:59:00Z", "date_only": false, "value": "2026-10-30T10:59:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / ClickHouse", "record": "CVE-2026-116366", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T15:00:13Z", "date_only": false, "value": "2026-10-30T15:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MfgnlkX-tQRfk7I4H0OQAxCbbpnzSQiiY4BT28yO-PM7BDA", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "89c53237-2033-49d0-a38e-801e3096ef8a", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 314964.969884, "hours": 87.49026941222223, "days": 3.645427892175926, "min_seconds": 314964.969884, "max_seconds": 314964.969884, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T10:59:00Z", "date_only": false, "value": "2026-10-30T10:59:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / ClickHouse", "record": "CVE-2026-116366", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T02:28:24.969Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 300491.969884, "hours": 83.46999163444445, "days": 3.477916318101852, "min_seconds": 300491.969884, "max_seconds": 300491.969884, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T15:00:13Z", "date_only": false, "value": "2026-10-30T15:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MfgnlkX-tQRfk7I4H0OQAxCbbpnzSQiiY4BT28yO-PM7BDA", "record": "CVE-2026-116366", "field": "creation_timestamp", "uuid": "89c53237-2033-49d0-a38e-801e3096ef8a", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-03T02:28:24.969Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}