ClickHouse prior to 19.13.5.44 allows HTTP header injection via the url table function.
yandex clickhouse