Is CVE-2024-22412 actively exploited?

No active exploitation of CVE-2024-22412 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-22412 be exploited remotely?

Yes. CVE-2024-22412 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-22412?

CVE-2024-22412 has a CVSS score of 4.9 (MEDIUM).

HOME VULNERABILITIESCVE-2024-22412

MEDIUM

CVE-2024-22412

CWE-863Published: March 18, 2024· Updated: Jun 17, 2026

4.9

CVSS v3.1

Official Description

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.

NVD Source

Technical Analysis

CVE-2024-22412 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 4.9.