CVE-2026-39196

Vulnerability

In Datadog Vector v0.54.0, the KeyPartitioner::partition function in src/sinks/clickhouse/sink.rs renders ClickHouse INSERT query templates per event before the batch is sent [1]. The rendered database and table values are passed to set_uri_query in src/sinks/clickhouse/service.rs, which builds an HTTP query parameter containing INSERT INTO ""."" FORMAT [1]. The database value is inserted into the SQL string without quote escaping (the table value uses table.replace('"', "\"")), so a pipeline using database = "{{ target_db }}" allows attacker-controlled event data to break out of the quoted identifier context and alter the target table [1]. The vulnerability is reachable when a ClickHouse sink template includes a user-supplied event field [1].

Exploitation

An attacker must be able to send an event into a Vector 0.54.0 pipeline configured with a ClickHouse sink using a database template like database = "{{ target_db }}" [1]. The attacker crafts an event containing a target_db field with SQL injection payload, e.g., {"message":"owned","target_db":"prod\".\"admin_logs\" FORMAT JSONEachRow -- "} [1]. When the event is processed, the rendered INSERT query uses the injected value to close the database identifier, insert a new FORMAT clause, and comment out the rest, redirecting the write to prod.admin_logs instead of the intended table [1]. No multi-statement execution is required; the injection occurs within a single SQL identifier context [1].

Impact

Successful exploitation allows the attacker to redirect Vector's ClickHouse INSERT operations to a different ClickHouse table that is reachable with Vector's database credential [1]. This can lead to unauthorized data writes, potential data corruption in unintended tables, and potential information disclosure if data is written to a less-protected table [1]. The fixed suffix safe_table in the example template is commented out, so the injected table name becomes the actual write target [1].

Mitigation

As of the available references, no fixed version has been released by Datadog for CVE-2026-39196 [1]. The vulnerability was discovered in Vector v0.54.0, and users should monitor for an updated release [1]. A workaround is to avoid using attacker-controlled event fields in ClickHouse sink database or table templates; static database and table values prevent the injection [1]. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication [1].