Inside Posthog: Ssrf, Clickhouse SQL Escape and Default Postgres Creds to Rce
Key topics
A thrilling tale of vulnerability chaining unfolded as a researcher exploited PostHog with a trifecta of SSRF, ClickHouse SQL escape, and default Postgres credentials to achieve RCE. Commenters debated whether PostHog's reliance on AI-generated code contributed to the security issues, with some arguing it wasn't necessarily "vibe coding." The discussion also shed light on the ClickHouse bug, with some pointing out that the real issue lay in the setup, not just the bug itself, and that fixing the underlying configuration would be more impactful. As the conversation unfolded, it became clear that the exploit chain was a complex, multi-faceted attack that highlighted the importance of robust security measures.
Snapshot generated from the HN discussion
Discussion Activity
Moderate engagementFirst comment
55m
Peak period
8
0-2h
Avg / period
3.6
Based on 36 loaded comments
Key moments
- 01Story posted
Dec 17, 2025 at 3:50 PM EST
16 days ago
Step 01 - 02First comment
Dec 17, 2025 at 4:45 PM EST
55m after posting
Step 02 - 03Peak activity
8 comments in 0-2h
Hottest window of the conversation
Step 03 - 04Latest activity
Dec 18, 2025 at 2:01 PM EST
15 days ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
I used to look up to Posthog as I thought, wow this is a really good startup. They’re achieving a lot fast actually.
But turns out a lot was sloppy. I don’t trust them no more and would opt for another platform now.
Unfortunately a lot of people think it means any time an LLM helps write code, but I think we're winning that semantic battle - I'm seeing more examples of it used correctly than incorrectly these days.
What an elegant, interesting read.
What I don't quite understand: Why is the Clickhouse bug not given more scrutiny?
Like that escape bug was what made the RCE possible and certainly a core DB company like ClickHouse should be held accountable for such an oversight?
No need for postgres if you have a fully authenticated user.
There as a actually a vulnerability Clickhouse, which helps you to execute any query on the remote postgresl. By default, you can't execute any random query! This bug was seperately reported to the Clickhouse and has been fixed seperately https://github.com/ClickHouse/ClickHouse/pull/74144/commits/...
It's worth noting that at the time of this report, this only affected PostHog's single tenant hobby deployment (i.e. our self hosted version). Our Cloud deployment used (and still uses) our Rust service for sending webhooks, which has had SSRF protection since May 2024[1].
Since this report we've evolved our Cloud architecture significantly, and we have similar IP-based filtering throughout our backend services.
[0] https://github.com/PostHog/posthog/pull/25398
[1] https://github.com/PostHog/posthog/commit/281af615b4874da1b8...
> As it described on Clickhouse documentation, their API is designed to be READ ONLY on any operation for HTTP GET As described in the Clickhouse documentation, their API is designed to be READ ONLY on any operation for HTTP GET requests.