Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL (https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-29 | 1 | Disclosure1 |
| 2026-09-06 | 1 | General1 |
CVE-2026-51992: ClickHouse SQL Injection Report Rejected - What It Means for Your Business and How to Respond https://hubs.li/Q04wPVt80
Post summary
The text merely references CVE-2026-51992 and points to a link for further reading, but provides no concrete details about exploitation, mitigation, or technical specifics.
CVE-2026-51992 SQL Injection in ClickHouse Server Versions 26.3.9.8 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-51992
Post summary
The post announces a SQL injection vulnerability affecting ClickHouse Server versions up to 26.3.9.8, with no additional details on exploitation, patches, or PoC.