Skip to main content
protocols.pageprotocols.page
8123

Port 8123 – ClickHouse HTTP

TCP

Port 8123 is the ClickHouse column-oriented database HTTP interface for queries and data ingestion. ClickHouse serves SQL queries over HTTP on port 8123 and native binary protocol on port 9000. Default installations allow unauthenticated queries. Enable authentication and restrict to analytics networks.

Port Number

8123

Protocol

TCP

Service

ClickHouse HTTP Interface

Range

IANA Registered (1024–49151)

Description

ClickHouse on port 8123 accepts SQL queries via HTTP POST and returns results in various formats (JSON, CSV, TabSeparated). The HTTP interface is used by web dashboards (Grafana, Metabase), CLI clients, and ETL pipelines for bulk data loading. ClickHouse processes analytical queries extremely fast – scanning billions of rows per second. An exposed port 8123 without authentication allows anyone to read all stored data and execute resource-intensive queries that could exhaust server memory/CPU. Configure users.xml with password authentication, bind to internal interfaces, and use a reverse proxy with TLS for external access. The native protocol on port 9000 provides better performance for high-throughput scenarios.

Security risks

  • 1No authentication by default: ClickHouse's default users.xml defines a 'default' user with no password and full access to all databases. Any HTTP request to port 8123 can query, insert, or drop tables. Attackers exfiltrate entire analytical datasets in seconds (ClickHouse scans billions of rows/second).
  • 2SQL injection via HTTP: ClickHouse accepts arbitrary SQL in HTTP POST body or query parameter. Unsanitized input in application-constructed queries allows UNION-based data extraction, system.query_log reading (reveals all prior queries), and file() function access to local filesystem.
  • 3CVE-2022-44011 (CVSS 7.5): ClickHouse heap buffer overflow in HTTP handler – crafted HTTP request causes denial of service or potential code execution on unpatched versions before 22.9.1.
  • 4system tables information disclosure: even read-only access exposes system.processes (running queries from other users), system.clusters (full cluster topology), system.users (all configured accounts), and system.query_log (historical queries including INSERT data).
  • 5Remote file access via url() and s3() table functions: ClickHouse can read from arbitrary URLs and S3 buckets. An attacker with query access can use these functions to exfiltrate data to external servers or scan internal network services (SSRF).

Firewall guidance

Never expose port 8123 to the internet. Bind to localhost or private interface: <listen_host>127.0.0.1</listen_host> in config.xml. Set passwords for ALL users in users.xml (including 'default'). Use HTTPS (port 8443) with proper certificates for cross-network access. Deploy ClickHouse Proxy or chproxy for connection pooling, auth enforcement, and query restrictions.

Diagnosis commands

Check if unauthenticated access works (should return 401 or 403)

shell
curl -s 'http://localhost:8123/?query=SELECT+currentUser()'

Get ClickHouse version (check for CVE patches)

shell
curl -s 'http://localhost:8123/?query=SELECT+version()'

List databases with authentication

shell
curl -s 'http://localhost:8123/?query=SHOW+DATABASES' -u default:password

Audit user authentication methods (look for no_password entries)

shell
curl -s 'http://localhost:8123/?query=SELECT+name,auth_type+FROM+system.users' -u admin:pass

Usage examples

Port 8123 – ClickHouse HTTP
shell
curl 'http://localhost:8123/?query=SELECT+1'
echo 'SELECT count() FROM events' | curl http://localhost:8123/ -d @-
clickhouse-client -h host --port 9000

Common services on this port

ClickHouse ServerClickHouse CloudAltinity.CloudDoubleCloudGrafana (queries ClickHouse)

Related ports

9000

ClickHouse native TCP protocol

9440

ClickHouse native TLS

8443

ClickHouse HTTPS

9009

ClickHouse inter-server replication

History

ClickHouse was developed at Yandex for web analytics (Yandex.Metrica) and open-sourced in 2016. Port 8123 was chosen for the HTTP interface alongside port 9000 for the native binary protocol. ClickHouse became the fastest open-source analytical database, processing billions of rows per second on commodity hardware. ClickHouse Inc. was founded in 2021 (spun out of Yandex) and launched ClickHouse Cloud. Authentication was optional by design for internal use at Yandex; it remains opt-in in open-source deployments.

FAQ

How do I enable authentication in ClickHouse?

In users.xml: change <password></password> to <password_sha256_hex>SHA256_HASH</password_sha256_hex> for the default user. Or use: CREATE USER admin IDENTIFIED BY 'strong_password'; GRANT ALL ON *.* TO admin; then set <access_management>1</access_management> in users.xml to enable SQL-driven user management. Restart ClickHouse. Test: curl http://localhost:8123/ should now return 401.

ClickHouse port 8123 (HTTP) vs 9000 (native) – which should applications use?

Native protocol (9000): binary format, 30-40% faster for large result sets, supports query progress callbacks, compression by default. Better for applications. HTTP (8123): simpler integration (any HTTP client works), better for dashboards (Grafana), supports output formats (JSON, CSV), easier to proxy/load-balance. Use 9000 for application backends; 8123 for dashboards, ad-hoc queries, and systems that only speak HTTP.