Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54658.
Unlock with Pro - from £29/user/moDetect CVE-2026-54658 - @hypequery/clickhouse SQL Injection via Parameter Escaping in Google Chronicle
@hypequery/clickhouse versions prior to 2.0.2 contain a SQL injection vulnerability (CWE-89) in their parameter escaping logic, allowing an attacker who controls query parameter input to inject arbitrary ClickHouse SQL. Successful exploitation permits unauthorized data disclosure, modification, or execution of arbitrary SQL statements against the backing ClickHouse database. CVSS 9.8. A public PoC/advisory exists (GHSA-6wcc-39rp-hh9p). Detections target anomalous ClickHouse query patterns (union-based, stacked queries, system table access, sleep/benchmark-based blind injection) originating from application service accounts using the hypequery client, as well as npm dependency footprint indicating vulnerable package versions.
MITRE ATT&CK
- Tactic
- Initial Access Collection Impact Execution
YARA-L Detection Query
rule cve_2026_54658_hypequery_clickhouse_sqli {
meta:
author = "df00tech"
description = "Detects SQL injection patterns targeting ClickHouse via vulnerable hypequery client (CVE-2026-54658)"
severity = "HIGH"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.target.port = 8123 or $e.target.port = 9000
$e.network.http.parsed_user_agent.original_string != ""
re.regex($e.network.http.referral_url, `(?i)(union\s+select|;\s*drop|sleep\(|benchmark\(|system\.tables|information_schema|'\s*or\s*'1'='1)`)
condition:
$e
}Chronicle YARA-L rule detecting HTTP/network traffic to ClickHouse ports containing classic SQL injection markers indicative of CVE-2026-54658 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate analytics platforms issuing UNION-based cross-table queries
- Internal monitoring tools polling system.tables for capacity planning
- Security assessment traffic from authorized penetration testers
Other platforms for CVE-2026-54658
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic UNION-based SQL injection against hypequery endpoint
Expected signal: HTTP access log entry with URI query parameter containing 'UNION SELECT' and 'system.users'; ClickHouse system.query_log entry reflecting the injected query.
- Test 2Blind time-based SQL injection via sleep()
Expected signal: Delayed HTTP response (~5s) correlated with an access log entry containing 'sleep(' in the query string; ClickHouse query log shows sleep() function execution.
- Test 3Stacked query injection attempting DROP TABLE
Expected signal: Access log entry containing '; DROP TABLE'; ClickHouse system.query_log showing an attempted or executed DROP TABLE statement outside expected application queries.
- Test 4System table enumeration via injected query
Expected signal: Web server access log and ClickHouse query log entries referencing 'system.tables' combined with a UNION SELECT clause.
References (10)
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-54658
- https://github.com/hypequery/hypequery/pull/349
- https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
- https://github.com/hypequery/hypequery/commit/2dc1df7bae
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://github.com/advisories/GHSA-6wcc-39rp-hh9p
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54658 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month