Tools / ClickHouse / Security

Security Deep Dive

ClickHouse

Security posture and CVE patch evidence from tracked releases.

Back to Tool

7 critical dependency CVEs affects v26.3.12.3-lts.

Audit transitive dependencies; consider upgrading or pinning replacements.

— Signed — SLSA — SBOM ✓ Security policy Weekly cadence · 0d median Active maintainer

Trust Signals — 3 of 9 Present

Evidence already collected from releases and repository metadata.

3/9 Present

Signed releases Unknown

Latest release artifact signature Latest release

—

SLSA provenance Unknown

Attestation predicate level Latest release

—

SBOM published Unknown

GitHub SBOM API Latest release

—

SECURITY.md Present

GitHub repository metadata Repository policy

Checked: 22d ago

Release cadence: weekly Present

0d median over recent releases Release history

Latest release: 12d ago

Maintainer active Present

Recent commit activity Repository

Last commit: today

Checksums (SHA256SUMS) Not active yet

SHA256SUMS or equivalent Release asset

Latest release: 12d ago

GitHub Actions attestation Not active yet

actions/attest-build-provenance Workflow file

Latest release: 12d ago

Signing assets Not active yet

.sig, .crt, cosign.pub, or similar Release asset

Latest release: 12d ago

3.8/10 Security Score

5.0/10 Scorecard

Dependency Exposure 91 transitive dependency CVEs found in the latest SBOM. 7 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

Up to date

scorecard

2.00 / 4.0

Score 5.0/10

cve health

0.00 / 2.5

⚠ No direct scan — 7c/33h transitive CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 95.1/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: estimated

Release responsiveness

release responsiveness

10.0

patch speed days: no_history

Dependency exposure

dependency exposure

0.5

10%

supply chain risk: 95.12 transitive cves: 7c/33h

Provenance trust

provenance trust

5.0

40%

scorecard score: 5.0 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 0d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none

How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 95.1/100

7 Transitive critical CVEs

0 KEV-transitive CVEs

44% Dependency freshness

Scorecard

Scorecard 5.0/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check	Score	Reason
Maintained	10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Code-Review	7	Found 9/12 approved changesets -- score normalized to 7
Security-Policy	10	security policy file detected
CII-Best-Practices	5	badge detected: Passing
License	10	license file detected
Packaging	-1	packaging workflow not detected
Branch-Protection	-1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Dangerous-Workflow	10	no dangerous workflow patterns detected
Signed-Releases	0	Project has not signed or included provenance with any releases.
Token-Permissions	0	detected GitHub workflow tokens with excessive permissions
Fuzzing	10	project is fuzzed
Binary-Artifacts	0	binaries present in source code
Pinned-Dependencies	0	dependency not pinned by hash detected -- score normalized to 0
SAST	0	SAST tool is not run on all commits -- score normalized to 0

Dependency Vulnerabilities

689 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

High

Medium

Low

Unknown

Still affecting latest (35) All (91)

Critical 7 High 33 Medium 41 Low 5 Unknown 5

CVE	Severity	KEV	Dependency	Affected version	Cleared in release
CVE-2017-18342	critical	—	pyyaml	—	v26.4.2.10-stable
CVE-2018-20060	critical	—	urllib3	—	v26.4.2.10-stable
CVE-2019-20477	critical	—	pyyaml	—	v26.4.2.10-stable
CVE-2019-6446	critical	—	numpy	—	v26.4.2.10-stable
CVE-2020-14343	critical	—	pyyaml	—	v26.4.2.10-stable
CVE-2020-1747	critical	—	pyyaml	—	v26.4.2.10-stable
CVE-2020-26759	critical	—	clickhouse-driver	—	v26.4.2.10-stable
CVE-2014-1402	high	—	jinja2	—	v26.4.2.10-stable
CVE-2014-1858	high	—	numpy	—	v26.4.2.10-stable
CVE-2014-1859	high	—	numpy	—	v26.4.2.10-stable
CVE-2016-10075	high	—	tqdm	—	v26.4.2.10-stable
CVE-2016-10745	high	—	jinja2	—	v26.4.2.10-stable
CVE-2017-12852	high	—	numpy	—	v26.4.2.10-stable
CVE-2018-18074	high	—	requests	—	v26.4.2.10-stable
CVE-2019-10906	high	—	jinja2	—	v26.4.2.10-stable
CVE-2019-11324	high	—	urllib3	—	v26.4.2.10-stable
CVE-2019-18874	high	—	psutil	—	v26.4.2.10-stable
CVE-2020-7212	high	—	urllib3	—	v26.4.2.10-stable
CVE-2021-32839	high	—	sqlparse	—	v26.4.2.10-stable
CVE-2021-33503	high	—	urllib3	—	v26.4.2.10-stable
CVE-2021-41495	high	—	numpy	—	v26.4.2.10-stable
CVE-2023-43804	high	—	urllib3	—	v26.4.2.10-stable
CVE-2024-4340	high	—	sqlparse	—	v26.4.2.10-stable
CVE-2025-66418	high	—	urllib3	2.4.0	v26.4.2.10-stable
CVE-2025-66471	high	—	urllib3	2.4.0	v26.4.2.10-stable
CVE-2026-0994	high	—	protobuf	4.25.8	v26.4.2.10-stable
CVE-2026-21441	high	—	urllib3	2.4.0	v26.4.2.10-stable
CVE-2026-24049	high	—	wheel	0.46.1	v26.4.2.10-stable
CVE-2026-24281	high	—	org.apache.zookeeper:zookeeper	3.8.4	v26.4.2.10-stable
CVE-2026-24308	high	—	org.apache.zookeeper:zookeeper	3.8.4	v26.4.2.10-stable
CVE-2026-26007	high	—	cryptography	44.0.1	v26.4.2.10-stable
CVE-2026-32597	high	—	pyjwt	2.10.1	v26.4.2.10-stable
CVE-2026-32829	high	—	lz4_flex	0.11.5	v26.4.2.10-stable
CVE-2026-33155	high	—	deepdiff	8.6.1	v26.4.2.10-stable
CVE-2026-3336	high	—	aws-lc-sys	0.30.0	v26.4.2.10-stable
CVE-2026-3337	high	—	aws-lc-sys	0.30.0	v26.4.2.10-stable
CVE-2026-3338	high	—	aws-lc-sys	0.30.0	v26.4.2.10-stable
CVE-2026-41066	high	—	lxml	5.3.0	v26.4.2.10-stable
CVE-2026-4428	high	—	aws-lc-sys	0.30.0	v26.4.2.10-stable
GHSA-82j2-j2ch-gfr8	high	—	rustls-webpki	0.103.4	v26.4.2.10-stable
CVE-2014-0012	medium	—	jinja2	—	v26.4.2.10-stable
CVE-2014-1829	medium	—	requests	—	v26.4.2.10-stable
CVE-2014-1830	medium	—	requests	—	v26.4.2.10-stable
CVE-2015-2296	medium	—	requests	—	v26.4.2.10-stable
CVE-2016-9015	medium	—	urllib3	—	v26.4.2.10-stable
CVE-2018-25091	medium	—	urllib3	—	v26.4.2.10-stable
CVE-2019-11236	medium	—	urllib3	—	v26.4.2.10-stable
CVE-2020-26137	medium	—	urllib3	—	v26.4.2.10-stable
CVE-2020-28493	medium	—	jinja2	—	v26.4.2.10-stable
CVE-2021-28363	medium	—	urllib3	—	v26.4.2.10-stable
CVE-2021-33430	medium	—	numpy	—	v26.4.2.10-stable
CVE-2021-34141	medium	—	numpy	—	v26.4.2.10-stable
CVE-2021-41496	medium	—	numpy	—	v26.4.2.10-stable
CVE-2023-30608	medium	—	sqlparse	—	v26.4.2.10-stable
CVE-2023-32681	medium	—	requests	2.25.0	v26.4.2.10-stable
CVE-2023-45803	medium	—	urllib3	—	v26.4.2.10-stable
CVE-2024-22195	medium	—	jinja2	—	v26.4.2.10-stable
CVE-2024-34064	medium	—	jinja2	—	v26.4.2.10-stable
CVE-2024-35195	medium	—	requests	2.25.0	v26.4.2.10-stable
CVE-2024-37891	medium	—	urllib3	—	v26.4.2.10-stable
CVE-2024-47081	medium	—	requests	2.25.0	v26.4.2.10-stable
CVE-2024-56201	medium	—	jinja2	—	v26.4.2.10-stable
CVE-2024-56326	medium	—	jinja2	—	v26.4.2.10-stable
CVE-2025-27516	medium	—	jinja2	—	v26.4.2.10-stable
CVE-2025-50181	medium	—	urllib3	2.4.0	v26.4.2.10-stable
CVE-2025-50182	medium	—	urllib3	2.4.0	v26.4.2.10-stable
CVE-2025-68146	medium	—	filelock	—	v26.4.2.10-stable
CVE-2025-69277	medium	—	pynacl	1.5.0	v26.4.2.10-stable
CVE-2025-71176	medium	—	pytest	—	v26.4.2.10-stable
CVE-2025-8869	medium	—	pip	25.0.1	v26.4.2.10-stable
CVE-2026-22701	medium	—	filelock	—	v26.4.2.10-stable
CVE-2026-25541	medium	—	bytes	1.10.1	v26.4.2.10-stable
CVE-2026-25645	medium	—	requests	2.32.4	v26.4.2.10-stable
CVE-2026-3219	medium	—	pip	26.0.1	v26.4.2.10-stable
CVE-2026-33055	medium	—	tar	0.4.44	v26.4.2.10-stable
CVE-2026-33056	medium	—	tar	0.4.44	v26.4.2.10-stable
CVE-2026-39373	medium	—	jwcrypto	1.5.6	v26.4.2.10-stable
CVE-2026-39892	medium	—	cryptography	45.0.4	v26.4.2.10-stable
CVE-2026-6357	medium	—	pip	26.0.1	v26.4.2.10-stable
GHSA-27jp-wm6q-gp25	medium	—	sqlparse	—	v26.4.2.10-stable
GHSA-pwjx-qhcg-rvj4	medium	—	rustls-webpki	0.103.4	v26.4.2.10-stable
CVE-2024-34062	low	—	tqdm	—	v26.4.2.10-stable
CVE-2026-1703	low	—	pip	25.0.1	v26.4.2.10-stable
CVE-2026-34073	low	—	cryptography	44.0.1	v26.4.2.10-stable
GHSA-965h-392x-2mh5	low	—	rustls-webpki	0.103.4	v26.4.2.10-stable
GHSA-xgp8-3hg3-c2mh	low	—	rustls-webpki	0.103.4	v26.4.2.10-stable
CVE-2020-13091	unknown	—	pandas	—	v26.4.2.10-stable
RUSTSEC-2026-0049	unknown	—	rustls-webpki	0.103.4	v26.4.2.10-stable
RUSTSEC-2026-0098	unknown	—	rustls-webpki	0.103.4	v26.4.2.10-stable
RUSTSEC-2026-0099	unknown	—	rustls-webpki	0.103.4	v26.4.2.10-stable
RUSTSEC-2026-0104	unknown	—	rustls-webpki	0.103.4	v26.4.2.10-stable

Showing 91 of 91