ClickHouse

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz P1, critical (floor $2,100) │ $2,500 │ $3,125 P2, high (floor $1,000) │ $1,250 │ $1,563 P3, medium (floor $100) │ $600 │ $750 P4, low (floor $50) │ $100 │ $125 Submit a vulnerability CVE history 13 Last 12 months 43 Lifetime Memory safety 35 % Denial of service 25 % Access control 20 % Parsing/validation 15 % Latest advisories Loading the feed Overview ClickHouse is the default open-source OLAP engine of the 2020s. It backs observability and product-analytics stacks at Cloudflare, Uber, eBay, Sentry, PostHog, Plausible and Grafana Cloud's traces backend, it is the storage layer inside a row of commercial products (Aiven, Altinity, Tinybird, DoubleCloud), and it is packaged in every major distro and cloud marketplace. Because it is habitually deployed as an internal analytics tier holding raw event and log data, an authentication or parser bug in ClickHouse tends to expose the highest-cardinality behavioural data an organisation owns. The scope here is unusually clean for a company-backed database: the Bugcrowd brief opens by asking researchers to "help us identify vulnerabilities in our open-source assets", and the repository's own SECURITY.md routes every vulnerability report into that paid program rather than to a private address. The ladder is modest, P1 pays $2,100 to $2,500, P4 pays $50 to $100, but the program is productive, with 149 rewarded findings at a mean payout of $338.87. sorona.xyz adds 1.25× on top of whatever ClickHouse awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The engagement asks researchers to "help us identify vulnerabilities in our open-source assets", and the repository's SECURITY.md routes every ClickHouse vulnerability report here, so the open-source engine is in scope in full across the P1 to P4 ladder clickhouse-server and everything a client can reach on it: the native TCP protocol, the HTTP interface, and the MySQL and PostgreSQL wire-protocol emulation The SQL surface: the parser, the analyser and the interpreter, along with the functions and aggregate functions the query engine exposes The input and output formats and the compression codecs, which are the widest untrusted-data surface the server has Table engines and the MergeTree storage layer, plus replication and distributed query execution across a cluster Table functions and external integrations: S3, URL, File, HDFS, the JDBC and ODBC bridges, and the Kafka, MySQL and PostgreSQL engines Authentication and the access-control model that separates tenants inside one cluster: users, roles, quotas, row policies and the LDAP and Kerberos paths User-defined and executable functions, which run code the server was configured to trust clickhouse-keeper, the Raft coordination service, and the clickhouse-client and clickhouse-local binaries shipped from the same repository ClickHouse-operated web properties, as secondary assets; the target list is deliberately narrow at a scope rating of 1 of 4 Out of scope Unsupported and end-of-life ClickHouse versions, which is the majority of released branches Performance and tuning problems rather than security problems: the brief lists "You need help tuning ClickHouse components for security" under when not to report a vulnerability Non-security functional bugs, which belong in the public issue tracker The standard Bugcrowd VRT out-of-scope categories: self-XSS, missing security headers, absent rate limiting and the rest Most-valued findings Pre-authentication remote code execution in clickhouse-server reached through the native or HTTP interface. It is the only class that lands at P1 and takes the $2,500 top of the ladder. Memory corruption in the SQL parser, the format readers or the codecs: 35% of this project's expected class mix and, historically, where most of its CVEs have actually been found Access-control failures that let one user read another user's data or escalate into a privileged role, which matters more here than the P-level suggests because ClickHouse is usually the tier holding an organisation's raw event and log data Arbitrary file read or write through clickhouse-local, which runs the same engine over local files with no server in front of it Server-side request forgery or file disclosure driven by the URL, S3, File and HDFS table functions, where a query author picks the destination the server then fetches A single crafted query that takes down a shared analytics cluster. Denial of service is 25% of the class mix, though it prices at P3 or P4 rather than at the top of the ladder. Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Report through the Bugcrowd engagement. ClickHouse's own SECURITY.md routes all open-source vulnerability reports there rather than to a private security address Bugcrowd's Standard Disclosure Terms are incorporated into the brief and take a perpetual, exclusive assignment of your testing results; the brief's negotiated-disclosure window does not override them, so read both before you file Reproduce on a supported release. Unsupported and end-of-life ClickHouse branches, which is most released branches, are out of scope Tuning and hardening questions are not vulnerability reports: "You need help tuning ClickHouse components for security" is listed under when not to report ClickHouse is OSS-Fuzz integrated, so a patch you land and keep merged upstream can separately earn up to $5,000 from Google Patch Rewards: different work, different terms, and a much lower routing risk than the bounty Maintainers acknowledge and analyse each report within five working days Program stats 149 Rewarded vulnerabilities $338.87 Average payout Jun 2022 Running since Disclosure Coordinated through Bugcrowd with Priority Triage, and ClickHouse's maintainers acknowledge each report within five working days. File through the engagement yourself and treat publication timing as theirs to agree. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability