CVE-2026-82306

Received Received - Intake

StarRocks Information Disclosure via Query History Exposure

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82306

EUVD

EUVD-2026-67823

Affected Vendors & Products

Vendor	Product	Version / Range
starrocks	starrocks	4.0.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

StarRocks versions up to 4.0.13 have an information disclosure vulnerability in the query_detail endpoint. Authenticated low-privilege attackers can access full query history of all users, including complete SQL statements, execution plans, and profiling data. This may expose sensitive information such as credentials embedded in queries.

Detection Guidance

Check if the /api/query_detail endpoint is accessible without proper authorization. Use curl to test: curl -u low_privilege_user:password http://starrocks-server:port/api/query_detail?event_time=0. If it returns query history from other users, the system is vulnerable.

Impact Analysis

An attacker with low privileges could steal sensitive data from other users' queries, including credentials, database contents, or internal operations. This could lead to further attacks like data breaches, unauthorized access, or privilege escalation within the system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy such as GDPR and HIPAA, as it exposes sensitive user data and query contents to unauthorized parties. Organizations using affected StarRocks versions may face regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade StarRocks to a version later than 4.0.13 where this issue is fixed. If immediate upgrade is not possible, restrict access to the /api/query_detail endpoint via network policies or firewall rules.

Hi! I’m here to help you understand CVE-2026-82306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70