Snapshot 226890
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust center Start your security review View & download sensitive information Ask for information Overview Welcome to ClickHouse's Trust center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust center to learn about our security posture and request access to our security documentation. Compliance CCPA EU-US DPF GDPR HIPAA ISO/IEC 27001 ISO/IEC 27001 SoA PCI DSS SOC 2 Type 2 ISO/IEC 27701 Documents DOCUMENTSBYOC Component List DOCUMENTSBYOC shared responsibility model DOCUMENTSClickHouse 2025 Non Resident Tax Form DOCUMENTSData processing locations DOCUMENTSForm 10F DOCUMENTSNo PE Form - India DOCUMENTSSecurity cloud responsibility matrix REPORTSHIPAA report REPORTSPCI DSS - SAQ A REPORTSPentest report REPORTSVulnerability assessment report COMPLIANCEHIPAA Risk profile Data access levelRestricted Impact levelModerate Critical dependenceYes View more Product security Audit logging Data security Integrations View more Reports PCI DSS - SAQ A Pentest report Vulnerability assessment report View more Data security Access monitoring Data erasure Data Masking View more App security Responsible disclosure Bot detection Secure development training View more AI AI Compliance Legal Acceptable Use Policy Modern Slavery & Human Trafficking Statement ClickHouse Security Standards View more Data privacy Cookies Data breach notifications Employee privacy training View more Access control Data access Logging Password security Infrastructure Status monitoring Amazon Web Services Anti-DDoS View more Endpoint security Disk encryption Endpoint detection and response Mobile device management View more Network security IDS/IPS Security information and event management Virtual private cloud Corporate security Employee training HR security Incident Response View more Internal Policies Data classification policy Information security policy Operations security policy View more Security Grades Qualys SSL Labs clickhouse.cloud A+ BC/DR Data backup/backup protection High availability Knowledge Base (FAQ) Federal: Is there a ClickHouse version that is secured for US Federal compliance? View more Trust center Updates CVE-2026-116366: Unauthenticated Remote Code Execution Vulnerability in ClickHouse Vulnerabilities ClickHouse has identified and remediated a Critical severity vulnerability (CVE-2026-116366) that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on a ClickHouse server. The vulnerability has a CVSS v4.0 base score of 9.5 (Critical): CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. ClickHouse Cloud and BYOC: All managed deployments, including ClickHouse Cloud and BYOC, have already been patched. We have no evidence that this vulnerability has been exploited in the ClickHouse Cloud environment. No action is required by our customers. Open-source and self-managed deployments: The fix has been backported to all supported versions listed in security.md. Please ensure your instances are running at least one of the following minimum versions: 26.3 → 26.3.62.3-lts 26.8 → 26.8.36.3-lts 26.9 → 26.9.27.3-stable 26.10 → 26.10.3.7-stable The versions can be found either at packages.clickhouse.com or the ClickHouse Docker registry. Further details are available in the ClickHouse security changelog. To subscribe to our embargo notification process use our Trust Center. The pull request containing the patch will be made public after Friday, November 13, 2026. If you have any questions or require assistance, please contact us at security@clickhouse.com. CVE-2026-111497: Brotli Decoder Vulnerability Affecting ClickHouse Server Vulnerabilities ClickHouse has identified and remediated a vulnerability in the Brotli decoder (CVE-2026-111497, CVSS 9.2), a third-party dependency used by ClickHouse Server. The vulnerability could allow specially crafted Brotli-compressed requests to cause ClickHouse Server crashes. ClickHouse Cloud and BYOC: All managed deployments, including ClickHouse Cloud and BYOC, have already been patched. We have no evidence that this vulnerability has been exploited in the ClickHouse Cloud environment. No action is required by our customers. Open-source and self-managed deployments: The fix has been backported to all supported versions listed in security.md. Please ensure your instances are running at least one of the following minimum versions: 26.3 → 26.3.62.3-lts 26.8 → 26.8.36.3-lts 26.9 → 26.9.27.3-stable 26.10 → 26.10.3.7-stable The versions can be found either at packages.clickhouse.com or the ClickHouse Docker registry. To subscribe to our embargo notification process use our Trust Center. If you have any questions or require assistance, please contact us at security@clickhouse.com. ClickHouse Response to the Latest LiteLLM Supply Chain Compromise Vulnerabilities ClickHouse is not impacted by the recent supply chain compromise affecting LiteLLM. Our security team has completed a thorough investigation and confirmed that LiteLLM is not used in our platform or its supporting infrastructure. No action is required by our customers. ClickHouse Response to the eMudhra Intermediate Certificates Disclosure Vulnerabilities ClickHouse is not impacted by the recently disclosed compromise of eMudhra intermediate certificates. Our security team has completed a thorough investigation and found no evidence of the affected eMudhra certificates being used in our infrastructure. ClickHouse uses Let’s Encrypt and AWS managed CA for server certificates, and DigiCert for code signing. As part of our regular container image update process, we will also update our images with the latest CA root stores. No action is required by our customers. ClickHouse Response to the Latest PHP Vulnerabilities Vulnerabilities ClickHouse managed versions including Cloud and BYOC are not impacted by the recently published vulnerabilities affecting PHP (CVE-2026-109618 and CVE-2026-109619). Our security team has completed a thorough investigation and confirmed that PHP is not used in our platform or its supporting infrastructure. No action is required by our customers. If you think you may have discovered a vulnerability, please send us a note. Report issue