8.8

CVE-2024-23689: ClickHouse Client Certificate Password Exposure

Modified
AliasesGHSA-g8ph-74m6-8m7r
Published 19-01-2024Last modified 14-07-2026

Vulnerability summary

CVE-2024-23689 is a high (CVSS 8.8) vulnerability in clickhouse java_libraries. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.68%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Timeline

  1. 19-01-2024
    PublishedVulnerability first disclosed.
  2. 14-07-2026
    Last modifiedVulnerability information updated.

Description

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.68%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.68% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Clickhouse Java

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Com.clickhouse3 products
  • clickhouse-client< 0.4.6
  • clickhouse-jdbc< 0.4.6
  • clickhouse-r2dbc< 0.4.6
Clickhouse1 product

2 vendors · 4 products

References

8 links