[Security] ClickHouse CVE-2026-116366 — Vulnerable Altinity build in Sentry Self-Hosted #4611

Self-Hosted Version

26.9.0

CPU Architecture

x86_64

Docker Version

29.4.0, build 9d7ad9f

Docker Compose Version

Docker Compose version v5.1.3

Machine Specification

• My system meets the minimum system requirements of Sentry

Installation Type

Existing installation (Sentry Self-Hosted 26.9.0)

Steps to Reproduce

1. Deploy Sentry Self-Hosted 26.9.0 using the official Docker Compose setup.

2. Access the ClickHouse container.

3. Run the following command to identify the installed ClickHouse version:
   clickhouse-client -q "SELECT version()"

4. Observe the installed ClickHouse version:
   25.8.28.10001.altinitystable

5. Review the publicly disclosed security advisory for CVE-2026-116366.

6. Verify whether this ClickHouse build includes a security fix for CVE-2026-116366.

No exploitation attempt was performed. This report concerns a potentially vulnerable ClickHouse dependency bundled with Sentry Self-Hosted.

Expected Result

Sentry Self-Hosted should provide a ClickHouse image that includes the security fix for CVE-2026-116366.

Ideally, we would like to know:

• Whether the ClickHouse version bundled with Sentry Self-Hosted 26.9.0 is confirmed to be affected.
• Whether a patched Altinity ClickHouse image is available or planned.
• Which Sentry Self-Hosted release will include the security fix.
• Whether there are recommended temporary mitigations while waiting for an updated image.

Since ClickHouse is a critical component of Sentry Self-Hosted, having an officially supported and patched version is important for production environments.

Actual Result

Our Sentry Self-Hosted 26.9.0 deployment is currently running the following ClickHouse version:
25.8.28.10001.altinitystable

Verified using:
clickhouse-client -q "SELECT version()"

Output:
25.8.28.10001.altinitystable

CVE-2026-116366 is a publicly disclosed critical ClickHouse vulnerability involving potential unauthenticated remote code execution.

Based on the available security information, older ClickHouse branches may also be affected. However, we have not independently verified whether the Altinity build used by our deployment includes a backported fix.

We would appreciate confirmation from the Sentry maintainers regarding the vulnerability status of this image and the availability of an officially supported patched version.

References:

• CVE-2026-116366 Affected Versions Confirmation ClickHouse/ClickHouse#128733
• https://clickhouse.com/docs/resources/changelogs/security-changelog
• https://altinity.com/news/important-security-advisory-for-altinity-builds-of-clickhouse

Event ID

No response