Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54658.
Unlock with Pro - from £29/user/moDetect CVE-2026-54658 - @hypequery/clickhouse SQL Injection via Parameter Escaping in Elastic Security
@hypequery/clickhouse versions prior to 2.0.2 contain a SQL injection vulnerability (CWE-89) in their parameter escaping logic, allowing an attacker who controls query parameter input to inject arbitrary ClickHouse SQL. Successful exploitation permits unauthorized data disclosure, modification, or execution of arbitrary SQL statements against the backing ClickHouse database. CVSS 9.8. A public PoC/advisory exists (GHSA-6wcc-39rp-hh9p). Detections target anomalous ClickHouse query patterns (union-based, stacked queries, system table access, sleep/benchmark-based blind injection) originating from application service accounts using the hypequery client, as well as npm dependency footprint indicating vulnerable package versions.
MITRE ATT&CK
- Tactic
- Initial Access Collection Impact Execution
Elastic Detection Query
sequence by client.ip with maxspan=5m
[network where destination.port in (8123, 9000) and http.request.body.content : ("*union*select*", "*sleep(*", "*benchmark(*", "*system.tables*", "*'1'='1*")]
[network where destination.port in (8123, 9000) and event.outcome == "success"]Identifies a sequence where a client sends a ClickHouse HTTP/native protocol request containing SQL injection markers and subsequently receives a successful response, indicating potential exploitation of CVE-2026-54658.
Data Sources
Required Tables
False Positives & Tuning
- Internal analytics dashboards issuing complex UNION queries as part of normal operation
- Database administrators running introspection queries against system.tables
- Load testing tools sending crafted payloads to non-production ClickHouse instances
Other platforms for CVE-2026-54658
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic UNION-based SQL injection against hypequery endpoint
Expected signal: HTTP access log entry with URI query parameter containing 'UNION SELECT' and 'system.users'; ClickHouse system.query_log entry reflecting the injected query.
- Test 2Blind time-based SQL injection via sleep()
Expected signal: Delayed HTTP response (~5s) correlated with an access log entry containing 'sleep(' in the query string; ClickHouse query log shows sleep() function execution.
- Test 3Stacked query injection attempting DROP TABLE
Expected signal: Access log entry containing '; DROP TABLE'; ClickHouse system.query_log showing an attempted or executed DROP TABLE statement outside expected application queries.
- Test 4System table enumeration via injected query
Expected signal: Web server access log and ClickHouse query log entries referencing 'system.tables' combined with a UNION SELECT clause.
References (10)
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-54658
- https://github.com/hypequery/hypequery/pull/349
- https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
- https://github.com/hypequery/hypequery/commit/2dc1df7bae
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://github.com/advisories/GHSA-6wcc-39rp-hh9p
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54658 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month