CVE-2026-51992 Overview
CVE-2026-51992 is a SQL injection vulnerability in ClickHouse Server versions <= 26.3.9.8. The flaw resides in the CREATE DICTIONARY function, which fails to properly sanitize attacker-controlled input passed to downstream data source queries. A remote, unauthenticated attacker can inject arbitrary SQL statements and achieve arbitrary code execution against the affected ClickHouse instance. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Remote unauthenticated attackers can execute arbitrary code against ClickHouse Server through injection in the CREATE DICTIONARY function, compromising database confidentiality and integrity.
Affected Products
- ClickHouse Server versions <= 26.3.9.8
- Deployments exposing the ClickHouse SQL interface to untrusted networks
- Applications forwarding user-controlled input to CREATE DICTIONARY statements
Discovery Timeline
- 2026-07-29 - CVE-2026-51992 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-51992
Vulnerability Analysis
ClickHouse supports external dictionaries as a mechanism for enriching queries with data pulled from external sources such as PostgreSQL, MySQL, and HTTP endpoints. The CREATE DICTIONARY statement accepts source configuration parameters that are forwarded to the underlying data source. In vulnerable versions, these parameters are concatenated into downstream SQL without adequate escaping.
An attacker who can issue CREATE DICTIONARY statements can embed malicious SQL fragments into the source configuration. Those fragments execute in the context of the connected external database, enabling arbitrary code execution paths depending on the backing engine. The ClickHouse SQL Dictionary Reference documents the source syntax abused by this issue.
Root Cause
The root cause is improper neutralization of special SQL characters when constructing dictionary source queries. User-supplied fields propagate into external database calls without parameterization, violating the guarantees expected of the SQL layer.
Attack Vector
Exploitation requires network access to the ClickHouse SQL interface and the ability to issue a CREATE DICTIONARY statement referencing an attacker-influenced source. No authentication or user interaction is required in configurations that expose SQL execution to unauthenticated clients. A public proof of concept is available at the GitHub PoC for CVE-2026-51992.
No verified exploit code is reproduced here. Refer to the linked public proof of concept for technical details.
Detection Methods for CVE-2026-51992
Indicators of Compromise
- Unexpected CREATE DICTIONARY statements in ClickHouse query logs, especially from application service accounts
- Outbound connections from ClickHouse hosts to unfamiliar PostgreSQL, MySQL, or HTTP endpoints referenced by dictionary sources
- SQL syntax containing stacked statements, comment sequences (--, /* */), or quote escapes inside dictionary source parameters
- Unexplained new dictionaries visible via SELECT * FROM system.dictionaries
Detection Strategies
- Enable and centralize ClickHouse query_log and query_thread_log and alert on CREATE DICTIONARY operations from non-administrative principals
- Compare current dictionary definitions against a known-good baseline and flag drift
- Inspect ClickHouse process telemetry for spawned child processes or unexpected library loads following dictionary creation
Monitoring Recommendations
- Forward ClickHouse audit logs to a centralized analytics platform for correlation with network and endpoint telemetry
- Monitor egress traffic from database hosts and alert on connections to non-approved external database endpoints
- Track privilege usage on the dictGet family of functions and dictionary DDL statements
How to Mitigate CVE-2026-51992
Immediate Actions Required
- Upgrade ClickHouse Server to a version later than 26.3.9.8 once a fixed release is available from the vendor
- Restrict CREATE DICTIONARY privileges to trusted administrative roles using ClickHouse role-based access control
- Block network access to the ClickHouse SQL interface from untrusted sources and require authenticated, mutually-TLS-protected connections
- Audit existing dictionaries and remove any that reference untrusted or unknown sources
Patch Information
At the time of publication, upgrade to a ClickHouse Server release beyond 26.3.9.8 when available. Review the ClickHouse SQL Dictionary Reference and vendor release notes for the fixed version.
Workarounds
- Revoke CREATE DICTIONARY and related DDL privileges from application-level accounts
- Enforce parameter allow-lists in application code that constructs ClickHouse DDL on behalf of users
- Place ClickHouse behind a query proxy or firewall that rejects CREATE DICTIONARY statements from untrusted principals
- Isolate external data source credentials so that a compromised ClickHouse instance cannot pivot to production databases
# Restrict CREATE DICTIONARY to administrative roles only
clickhouse-client --query "REVOKE CREATE DICTIONARY ON *.* FROM app_user"
clickhouse-client --query "GRANT CREATE DICTIONARY ON *.* TO db_admin"
# Audit existing dictionaries for suspicious sources
clickhouse-client --query "SELECT database, name, source FROM system.dictionaries"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
