Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54658.
Unlock with Pro - from £29/user/moDetect CVE-2026-54658 - @hypequery/clickhouse SQL Injection via Parameter Escaping in Splunk
@hypequery/clickhouse versions prior to 2.0.2 contain a SQL injection vulnerability (CWE-89) in their parameter escaping logic, allowing an attacker who controls query parameter input to inject arbitrary ClickHouse SQL. Successful exploitation permits unauthorized data disclosure, modification, or execution of arbitrary SQL statements against the backing ClickHouse database. CVSS 9.8. A public PoC/advisory exists (GHSA-6wcc-39rp-hh9p). Detections target anomalous ClickHouse query patterns (union-based, stacked queries, system table access, sleep/benchmark-based blind injection) originating from application service accounts using the hypequery client, as well as npm dependency footprint indicating vulnerable package versions.
MITRE ATT&CK
- Tactic
- Initial Access Collection Impact Execution
SPL Detection Query
index=web_logs OR index=app_logs ("clickhouse" OR "hypequery")
| rex field=_raw "(?<extracted_query>(?i)(union\s+select|;\s*drop|sleep\(|benchmark\(|system\.tables|system\.users|system\.processes|information_schema|'\s*or\s*'1'='1))"
| where isnotnull(extracted_query)
| stats count min(_time) as first_seen max(_time) as last_seen values(extracted_query) as injection_patterns by src_ip, uri_path, host
| where count > 0
| sort -last_seenSearches web and application logs for ClickHouse queries generated via hypequery containing classic SQL injection tokens (union-based, stacked queries, blind time-based, system table enumeration).
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate BI/reporting queries referencing system tables for observability
- Penetration test traffic from authorized red team engagements
- Third-party monitoring agents polling ClickHouse system tables
Other platforms for CVE-2026-54658
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic UNION-based SQL injection against hypequery endpoint
Expected signal: HTTP access log entry with URI query parameter containing 'UNION SELECT' and 'system.users'; ClickHouse system.query_log entry reflecting the injected query.
- Test 2Blind time-based SQL injection via sleep()
Expected signal: Delayed HTTP response (~5s) correlated with an access log entry containing 'sleep(' in the query string; ClickHouse query log shows sleep() function execution.
- Test 3Stacked query injection attempting DROP TABLE
Expected signal: Access log entry containing '; DROP TABLE'; ClickHouse system.query_log showing an attempted or executed DROP TABLE statement outside expected application queries.
- Test 4System table enumeration via injected query
Expected signal: Web server access log and ClickHouse query log entries referencing 'system.tables' combined with a UNION SELECT clause.
References (10)
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-54658
- https://github.com/hypequery/hypequery/pull/349
- https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
- https://github.com/hypequery/hypequery/commit/2dc1df7bae
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
- https://github.com/advisories/GHSA-6wcc-39rp-hh9p
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54658 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month