ClickHouse Disables Default-User Network Access After DeepSeek Database Exposure

Article Details

Defense Focus

Prevent and detect exposed or misconfigured ClickHouse databases, especially instances allowing public, unauthenticated access, and reduce the risk of data exposure through continuous configuration monitoring and secure access controls.

Detection Methods

• Use Wiz inventory to identify ClickHouse instances across cloud environments.
• Use Wiz policy findings to identify publicly exposed instances and configurations allowing remote anonymous access to the ClickHouse database API.
• Continuously assess configuration changes and prioritize findings using their cloud and data-exposure context.
• Review ClickHouse system.session_log for successful and failed authentication attempts, source IPs, client types, and network interfaces.
• Review ClickHouse system.query_log for query activity, returned rows and bytes, timestamps, and originating client IPs.
• Use crash_log, error_log, and text_log to investigate service crashes or denial-of-service incidents.

Data Sources

• Wiz cloud inventory and ClickHouse technology findings
• Wiz Host Configuration Rules findings
• Cloud network and access-control configuration
• ClickHouse system.session_log
• ClickHouse system.query_log
• ClickHouse crash_log, error_log, and text_log

Rule Types

• Wiz Host Configuration Rules policy check: “Clickhouse allows remote anonymous access to API database”
• ClickHouse query masking rules configured with regular expressions to sanitize logs

Platforms

• Cloud environments
• Self-managed and on-premises database deployments

Defensive Actions

• Avoid exposing database instances publicly unless access is explicitly required; restrict network access with firewalls, security groups, IP filtering, or private-interface binding.
• Set a password for the default user and require authentication; the article notes that official ClickHouse images now disable network access for the default user by default.
• Enable TLS for client connections and disable unnecessary server network interfaces.
• Apply role-based, least-privilege permissions and restrict access to sensitive databases, tables, and rows.
• Set query quotas and limits on memory, rows read, result rows, and result bytes; use read-only access where appropriate.
• Use ClickHouse audit logs to investigate authentication and query activity, and configure credential masking to reduce sensitive-data exposure in logs.
• Use Wiz continuous assessments, alerts, and remediation workflows to address high-risk configuration findings.