Security Researchers Discover RCE Chain in PostHog Analytics Platform Through SSRF, ClickHouse Zero-Day, and Default PostgreSQL Credentials
By
arwt
Master baker tier. Every paragraph earns its place on the tray.
Summary
A security research team discovered multiple critical vulnerabilities in PostHog analytics platform that could be chained together for remote code execution. The vulnerabilities included SSRF (Server-Side Request Forgery), a ClickHouse SQL escaping zero-day, and default PostgreSQL credentials. The researchers found these issues during a 24-hour security review before considering adopting PostHog for their team's analytics needs. The article details how these vulnerabilities could be exploited in sequence to achieve RCE, highlighting serious security flaws in a popular analytics product.
Key quotes
· 3 pulledWe have a somewhat unconventional—some might say non-scalable—approach to vendor selection. Before we seriously consider adopting a product, we give ourselves a strict 24-hour 'research window.' Not a marketing review. Not a feature comparison spreadsheet. A hands-on, source-level, deep dive
It's one of the brilliant -I personally believe it's the best- products on the market. And that's where the story has begun...
Our team was internally discussing moving to a different platform analytics solution. Our team was really leaning more towards Posthog.
You might also wanna read
OpenSSL Vulnerability CVE-2025-15467: Stack Overflow with Remote Code Execution Risk
JFrog Security Research team reports on a newly disclosed OpenSSL vulnerability, CVE-2025-15467, which is a stack overflow issue that could
Notion AI Vulnerability Enables Data Exfiltration Through Prompt Injection Attacks
Notion AI has a security vulnerability that allows data exfiltration through indirect prompt injection attacks. The vulnerability occurs bec
promptarmor.com·4mo ago
Critical Vulnerability in GoSign Desktop Allows Remote Code Execution via Insecure Updates
Security researcher Pasquale 'sid' Fiorillo discovered a critical vulnerability in GoSign Desktop software (version <= 2.4.0) that allows re
ush.it·6mo ago
Critical Redis Vulnerability (CVE-2025-49844) Allows Remote Code Execution with Maximum CVSS Score
Wiz Research has discovered a critical remote code execution vulnerability (CVE-2025-49844, nicknamed #RediShell) in Redis, the widely used
wiz.io·7mo ago
Critical Buffer Overflow Vulnerability Discovered in cURL Cookie Parsing Mechanism
A security researcher discovered a critical stack-based buffer overflow vulnerability in cURL's cookie parsing mechanism that can lead to re
Prompt Injection Attacks: The Top Security Threat Hijacking AI Chatbots
Prompt injection attacks are a critical security vulnerability in AI systems where hidden instructions within user data (like emails or docu
buff.ly·11h ago