CVE-2026-51992

✕ Withdrawn — historical dataCRITICALPre-NVD 9.1
9.1CVSS

SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function.

CVSS v3
9.1
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

July 29, 2026

Last Modified

August 5, 2026

References (2)

Frequently asked(4)

What is CVE-2026-51992?
CVE-2026-51992 is a rejected CVE ID: its record was withdrawn on August 6, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in…
When was the CVE record for CVE-2026-51992 published?
The CVE record for CVE-2026-51992 was published on July 29, 2026. EchelonGraph's copy of the record carries a last-modified date of August 5, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-51992?
CVE-2026-51992 has a CVSS v3.1 base score of 9.1 (CISA-ADP / Vulnrichment enrichment; NVD's own analysis pending).
How do I remediate CVE-2026-51992?
There is nothing to remediate under CVE-2026-51992: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.