Skip to content

Access Control: ClickHouse Authentication Disabled

Identifier: clickhouse_no_auth

Scanner Support

GraphQL Scanner REST Scanner WebApp Scanner ASM Scanner Automated Pentest

Description

ClickHouse services without authentication can allow unauthenticated users to query or alter data.

How we test: We attempt a benign ClickHouse query without credentials and report the issue when the server accepts the unauthenticated request.

Configuration

Example

Example configuration:

---
security_tests:
  clickhouse_no_auth:
    skip: false

Reference

skip

Type: boolean

Skip the test if true.