Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54658.
Unlock with Pro - from £29/user/moDetect CVE-2026-54658 - @hypequery/clickhouse SQL Injection via Parameter Escaping in IBM QRadar
@hypequery/clickhouse versions prior to 2.0.2 contain a SQL injection vulnerability (CWE-89) in their parameter escaping logic, allowing an attacker who controls query parameter input to inject arbitrary ClickHouse SQL. Successful exploitation permits unauthorized data disclosure, modification, or execution of arbitrary SQL statements against the backing ClickHouse database. CVSS 9.8. A public PoC/advisory exists (GHSA-6wcc-39rp-hh9p). Detections target anomalous ClickHouse query patterns (union-based, stacked queries, system table access, sleep/benchmark-based blind injection) originating from application service accounts using the hypequery client, as well as npm dependency footprint indicating vulnerable package versions.
MITRE ATT&CK
- Tactic
- Initial Access Collection Impact Execution
QRadar Detection Query
SELECT sourceip, destinationip, "URL", payload, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%'
AND (UTF8(payload) ILIKE '%union select%'
OR UTF8(payload) ILIKE '%; drop%'
OR UTF8(payload) ILIKE '%sleep(%'
OR UTF8(payload) ILIKE '%benchmark(%'
OR UTF8(payload) ILIKE '%system.tables%'
OR UTF8(payload) ILIKE '%information_schema%'
OR UTF8(payload) ILIKE '%''1''=''1%')
AND ("URL" ILIKE '%clickhouse%' OR "URL" ILIKE '%query%')
LAST 60 MINUTESQueries QRadar event payloads for SQL injection indicators in requests targeting ClickHouse query endpoints, indicative of CVE-2026-54658 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate reporting tools issuing UNION queries against ClickHouse for cross-table analytics
- Vulnerability scanners intentionally probing for injection as part of authorized assessments
- Encoded but benign query strings that coincidentally match substring patterns
Other platforms for CVE-2026-54658
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic UNION-based SQL injection against hypequery endpoint
Expected signal: HTTP access log entry with URI query parameter containing 'UNION SELECT' and 'system.users'; ClickHouse system.query_log entry reflecting the injected query.
- Test 2Blind time-based SQL injection via sleep()
Expected signal: Delayed HTTP response (~5s) correlated with an access log entry containing 'sleep(' in the query string; ClickHouse query log shows sleep() function execution.
- Test 3Stacked query injection attempting DROP TABLE
Expected signal: Access log entry containing '; DROP TABLE'; ClickHouse system.query_log showing an attempted or executed DROP TABLE statement outside expected application queries.
- Test 4System table enumeration via injected query
Expected signal: Web server access log and ClickHouse query log entries referencing 'system.tables' combined with a UNION SELECT clause.
References (10)
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-54658
- https://github.com/hypequery/hypequery/pull/349
- https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
- https://github.com/hypequery/hypequery/commit/2dc1df7bae
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://github.com/advisories/GHSA-6wcc-39rp-hh9p
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54658 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month