atlas security scan now matches the server version of each database against the CVEs published for its engine, in addition to the installed extensions.

The cve check of atlas security scan now matches the server version of each scanned database against the CVEs the Security Graph holds for its engine. A server is reported until it runs a release that carries the fix, whether or not it has extensions installed.

atlas security scan --url "clickhouse://default:pass@localhost:9000"

Scanning 1 database for security issues:

  -- clickhouse://default:xxxxx@localhost:9000 (clickhouse 23.10.5.20):
    -- Engine "clickhouse" version "23.10.5.20" is vulnerable to CVE-2024-22412 (ELEVATED):
       ClickHouse's Role-based Access Control is bypassed when query caching is enabled. Upgrade
       database engine "clickhouse" to version 23.12.6.19 or later to resolve CVE-2024-22412
    -- Engine "clickhouse" version "23.10.5.20" is vulnerable to CVE-2026-116366 (CRITICAL):
       Unauthenticated RCE vulnerability against ClickHouse Server. Upgrade database engine
       "clickhouse" to version 26.3.62.3 or later to resolve CVE-2026-116366

  -------------------------
  -- 409.516708ms
  -- 2 issues found: 1 critical, 1 elevated

Each finding names the engine, the server version, and the release to upgrade to. Upgrading the server above to 26.3.62.3 resolves both findings.

Engines

Engine	Checked
PostgreSQL	The server version and the installed extensions
MySQL, MariaDB	The server version
ClickHouse	The server version

Atlas detects MariaDB from the server version, so a MariaDB server behind a mysql:// URL is checked against MariaDB CVEs. The server version of other engines, such as SQL Server and SQLite, is not checked: the scan succeeds and reports no issues.

Reports and Templates

A finding of the server version sets Engine in place of Name in the JSON output and the --format template, and engine in the scan scope of a notify block.
A clean database reports no issues found in the server version, followed by the number of extensions when it has any.

atlas security scan \
  --url "postgres://postgres:pass@localhost:5432/app?sslmode=disable" \
  --url "clickhouse://default:pass@localhost:9000" \
  --format '{{ range .Targets }}{{ range .Vulnerabilities }}{{ println (or .Engine .Name) .ID .Level .Severity }}{{ end }}{{ end }}'

vector CVE-2026-103484 HIGH HIGH
vector CVE-2026-18022 HIGH HIGH
clickhouse CVE-2024-22412 ELEVATED LOW
clickhouse CVE-2026-116366 CRITICAL CRITICAL

GitHub Action and Kubernetes Operator

From v1.17.13, the ariga/atlas-action/security/scan action reports a finding of the server version as a warning annotation that names the engine, and lists it in the step summary under Engine / Extension.

From v0.8.6, the Kubernetes Operator stores it in the AtlasSecurityReport with engine set and extension empty, and the Ready message names the server version, as in 2 findings (1 CRITICAL, 1 ELEVATED) in the server version. The report entry of CVE-2026-116366 for the server above:

- cvssSeverity: CRITICAL
  description: An issue has been discovered in ClickHouse Server that, under certain
    conditions, could allow an unauthenticated user with network access to execute
    arbitrary code on the ClickHouse Server.
  engine: clickhouse
  extension: ""
  id: CVE-2026-116366
  level: CRITICAL
  suggestion: Upgrade database engine "clickhouse" to version 26.3.62.3 or later
    to resolve CVE-2026-116366
  title: Unauthenticated RCE vulnerability against ClickHouse Server
  version: 23.10.5.20

atlas security scan is available to Atlas Pro users with the Security Graph enabled in their plan. Get started by running atlas login, or read more about Atlas Pro. On the Kubernetes Operator, cloud.tokenFrom references a bot token.

See Security Scanning and Security Scanning with the Operator for the full reference.

Security Scan: Database Server CVEs

Engines

Reports and Templates

GitHub Action and Kubernetes Operator