How severe is CVE-2024-22412?

CVE-2024-22412 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-22412 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-22412?

CVE-2024-22412 primarily affects Clickhouse. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-22412?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-22412 have an EU (EUVD) identifier?

Yes. CVE-2024-22412 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19964.

When was CVE-2024-22412 published?

CVE-2024-22412 was published on 2024-03-18 and last updated on 2026-06-17.

CVE-2024-22412

CVE-2024-22412 is a low-severity vulnerability in Clickhouse with a CVSS 3.x base score of 2.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: Low (CVSS 3.x base score 2.4)
EPSS exploit prediction: 1% (44th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-19964
Weakness: CWE-863
Affected product: Clickhouse
Published: 2024-03-18
Last modified: 2026-06-17

Description

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.

Frequently asked questions

What is CVE-2024-22412?: ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.
How severe is CVE-2024-22412?: CVE-2024-22412 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-22412 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-22412?: CVE-2024-22412 primarily affects Clickhouse. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-22412?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-22412 have an EU (EUVD) identifier?: Yes. CVE-2024-22412 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19964.
When was CVE-2024-22412 published?: CVE-2024-22412 was published on 2024-03-18 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*

More vulnerabilities in Clickhouse

CVE-2019-16535 — Critical (CVSS 9.8): In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms…
CVE-2018-14671 — Critical (CVSS 9.8): In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a…
CVE-2018-14670 — Critical (CVSS 9.8): Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.
CVE-2019-16536 — High (CVSS 8.8): Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
CVE-2021-43305 — High (CVSS 8.8): Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification…
CVE-2021-43304 — High (CVSS 8.8): Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification…

All CVEs affecting Clickhouse →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →