CVE-2024-22412

What it actually does

Query cache keys only on user identity and ignores role-based access controls and row/column policies, allowing cached results from one role context to be returned to another user sharing the same role but subject to different policies.

Why it matters to the business

Organizations relying on ClickHouse roles for data segmentation face unauthorized data exposure, compliance violations, and loss of trust in access controls when query caching is enabled.

How an attack unfolds

An attacker who can influence or observe queries under a shared role crafts or replays queries that populate the cache, then queries the same statement under a different role context; the cache returns results that bypass the attacker's assigned policies because the cache does not re-evaluate roles.

How to fix it

Upgrade ClickHouse to version 24.1 or later, or apply commit 04075bf96a13f88d94b1d22f2ad6790c8ebb7875; ClickHouse Cloud customers must move to version 24.0.2.54535 or newer. Disable query caching until the upgrade if roles are used for access control.

How to confirm the fix worked

Confirm the running version is 24.1+ or contains commit 04075bf96a13f88d94b1d22f2ad6790c8ebb7875; test that identical queries under different roles within the same user return distinct results when policies differ; review query_log for cache hits that cross role boundaries.

Typical attack path

1. Obtain or control an account that shares a role with other users
2. Issue or guess a query that produces sensitive results under a permissive role context
3. Allow the query result to be stored in the cache
4. Switch to a more restricted role or user context and re-issue the identical query
5. Receive cached data that violates the current role's policies

How to detect it

Search query_log and system.query_cache for repeated identical queries returning results across different role contexts; look for cache hit events where the executing user and role combination differs from the cached entry's original context.

What your security team should do

• Immediately upgrade all ClickHouse deployments to a fixed version
• Temporarily disable query cache in environments that enforce role-based policies
• Audit role definitions and query patterns for shared roles that could be abused
• Add monitoring for unexpected cache hits on sensitive tables