DeepSeek leaves ClickHouse database open: chat logs and API keys exposed
Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.
Teaser aus der Quelle
Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.
Dies ist ein Anriss aus dem RSS-Feed. Den vollständigen Artikel lesen Sie beim Original.
Artikel bei pwn.watch lesenMehr zu ClickHouse
Weitere Advisories
- KritischCVE-2026-116366ClickHouse: Ganzzahlüberlauf
- KritischCVE-2026-116366ClickHouse: Ganzzahlüberlauf
- KritischCVE-2026-116366ClickHouse Server: unauthenticated remote code execution (CVE-2026-116366)
- Ohne Bewertungosv:CVE-2026-116818OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
- Ohne Bewertungosv:CVE-2026-116815OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts
- Ohne Bewertungosv:CVE-2026-116813OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
- Ohne Bewertungosv:CVE-2026-116812OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter
- Ohne Bewertungosv:CVE-2026-116808OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
Quelle: https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025