Servers and applications

CVE-2018-14668

In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.

Severity: High 8.8
Published: 15 Aug 2019
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 1.1.54388
Exploit chance: 0.7% in the next 30 daysHigher than 54% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources: NVD

Affected software

Software	Affected versions
ClickHouseServers and applications · `cpe:a:clickhouse:clickhouse`	Every version before 1.1.54388

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2018-14668
CVE.org https://www.cve.org/CVERecord?id=CVE-2018-14668