ClickHouse SQLi hits 9.1, PCP ships four bugs including a root privesc chain

An unauthenticated attacker can send crafted requests to PCP's pmproxy /store endpoint to overwrite any PMDA metric. That metric overwrite can chain into arbitrary code execution and full system takeover. If pmproxy is reachable from the network, no credentials are required.

Affected estate

Linux sysadmins running PCP with pmproxy exposed on the network

How to check

Run `ss -tlnp | grep pmproxy` to check if pmproxy is listening. Then verify whether the port is exposed externally via firewall rules or a port scan.

Included because

unauthenticated; network-reachable; code execution; no user interaction; CVSS 7.3

Action

Update PCP to the patched release. As a stopgap, restrict pmproxy access to localhost or trusted management networks only.

Why it matters

Unauthenticated remote code execution with no user interaction. If pmproxy faces the network, you're one HTTP request away from a compromised host.

ClickHouse Server versions 26.3.9.8 and older have a SQL injection bug in the dictionary creation function. A remote attacker can use it to execute arbitrary code on the server. The CVSS 9.1 reflects how little is needed to pull this off.

Affected estate

Anyone running ClickHouse Server version 26.3.9.8 or earlier

How to check

Run `clickhouse-server --version` or query `SELECT version()` from any ClickHouse client.

Included because

remote code execution; critical CVSS 9.1; common analytics database; SQL injection

Action

Upgrade ClickHouse Server past 26.3.9.8. Restrict CREATE DICTIONARY permissions to trusted users as an interim control.

Why it matters

SQL injection leading to arbitrary code execution on your database server, with a CVSS of 9.1.

PCP's linux_sockets module exposes an unsecured internal connection that an attacker with existing code execution can use to escalate privileges to root. This isn't a remote entry point on its own, but it turns any lower-privilege foothold into full root access.

Affected estate

Linux sysadmins running PCP with the linux_sockets module enabled

How to check

Check for the linux_sockets PMDA in `/etc/pcp/pmcd/pmcd.conf` or run `pminfo network.persocket` to see if the module is loaded.

Included because

privilege escalation to root; CVSS 8.8; chains with other PCP bugs in this batch

Action

Update PCP packages. If no fix is available, disable the linux_sockets PMDA to remove the privilege escalation path.

Why it matters

Any attacker with initial code execution on the host can escalate to root through this unsecured connection.

Flyto2 Core before version 2.26.7 lets attacker-controlled URLs pass through a dozen HTTP-emitting modules without any validation. That means an attacker who can influence workflow inputs can make the server send requests to internal services or cloud metadata endpoints (SSRF). If you're running this in a cloud environment, that's a straight path to credential theft from the metadata service.

Affected estate

Teams running Flyto2 Core for automation or AI-agent workflows at versions before 2.26.7

How to check

Check your Flyto2 Core version in your package manifest (e.g., pip show flyto2-core or your lockfile). Versions before 2.26.7 are vulnerable.

Included because

SSRF; cloud metadata exposure risk; CVSS 8.5; fix available

Action

Upgrade to Flyto2 Core 2.26.7. If you can't upgrade immediately, block outbound requests to internal IP ranges and cloud metadata endpoints at the network level.

Why it matters

SSRF from workflow inputs can reach internal services and cloud metadata endpoints, potentially leaking credentials and secrets.