CVE-2026-82306

Published: Aug 28, 2026Modified: Aug 31, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: disclosure@vulncheck.com (Secondary)

Description

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/StarRocks/starrocks

Source: disclosure@vulncheck.com

https://github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/QueryDetailAction.java

Source: disclosure@vulncheck.com

https://github.com/StarRocks/starrocks/issues/75747

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/starrocks-query-detail-endpoint-returns-every-user-s-query-history

Source: disclosure@vulncheck.com

Timeline

No history available yet.