Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54658.
Unlock with Pro - from £29/user/moDetect CVE-2026-54658 - @hypequery/clickhouse SQL Injection via Parameter Escaping in Microsoft Sentinel
@hypequery/clickhouse versions prior to 2.0.2 contain a SQL injection vulnerability (CWE-89) in their parameter escaping logic, allowing an attacker who controls query parameter input to inject arbitrary ClickHouse SQL. Successful exploitation permits unauthorized data disclosure, modification, or execution of arbitrary SQL statements against the backing ClickHouse database. CVSS 9.8. A public PoC/advisory exists (GHSA-6wcc-39rp-hh9p). Detections target anomalous ClickHouse query patterns (union-based, stacked queries, system table access, sleep/benchmark-based blind injection) originating from application service accounts using the hypequery client, as well as npm dependency footprint indicating vulnerable package versions.
MITRE ATT&CK
- Tactic
- Initial Access Collection Impact Execution
KQL Detection Query
let SuspiciousTokens = dynamic(["UNION SELECT","union select","; DROP","; drop","sleep(","SLEEP(","benchmark(","BENCHMARK(","system.tables","system.users","system.processes","xp_cmdshell","information_schema","' OR '1'='1","' or '1'='1"]);
AppServiceHTTPLogs
| where TimeGenerated > ago(1h)
| where CsUriQuery has_any ("clickhouse", "query") or CsUriStem has_any ("clickhouse","query","analytics")
| extend DecodedQuery = url_decode(CsUriQuery)
| where DecodedQuery has_any (SuspiciousTokens)
| project TimeGenerated, CIp, CsUriStem, DecodedQuery, ScStatus, _ResourceId
| union (
ContainerLogV2
| where TimeGenerated > ago(1h)
| where LogMessage has "clickhouse" or LogMessage has "hypequery"
| where LogMessage has_any (SuspiciousTokens)
| project TimeGenerated, ContainerId, LogMessage
)
| sort by TimeGenerated descDetects HTTP requests or application logs containing SQL injection patterns targeting ClickHouse queries, consistent with exploitation of the @hypequery/clickhouse parameter escaping vulnerability.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate analytics queries that reference system tables for monitoring/introspection
- Automated security scanning or QA fuzz testing hitting the application endpoints
- Developers testing edge cases with SQL-like strings in staging environments
- Log aggregation tools that legitimately reference 'union' or 'select' in non-SQL contexts
Other platforms for CVE-2026-54658
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic UNION-based SQL injection against hypequery endpoint
Expected signal: HTTP access log entry with URI query parameter containing 'UNION SELECT' and 'system.users'; ClickHouse system.query_log entry reflecting the injected query.
- Test 2Blind time-based SQL injection via sleep()
Expected signal: Delayed HTTP response (~5s) correlated with an access log entry containing 'sleep(' in the query string; ClickHouse query log shows sleep() function execution.
- Test 3Stacked query injection attempting DROP TABLE
Expected signal: Access log entry containing '; DROP TABLE'; ClickHouse system.query_log showing an attempted or executed DROP TABLE statement outside expected application queries.
- Test 4System table enumeration via injected query
Expected signal: Web server access log and ClickHouse query log entries referencing 'system.tables' combined with a UNION SELECT clause.
References (10)
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-54658
- https://github.com/hypequery/hypequery/pull/349
- https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
- https://github.com/hypequery/hypequery/commit/2dc1df7bae
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://github.com/advisories/GHSA-6wcc-39rp-hh9p
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54658 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month