CVE-2026-82306
StarRocks Query Detail Endpoint Returns Every User's Query History
- State
- Published
- Severity
- 6.5 Medium
- Published
- Aug 28, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 28, 2026
Description
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
starrocksStarRocks |
|
References
- GitHub Issue #75747issue-tracking
- Vulnerable code: QueryDetailAction.javatechnical-description
- https://github.com/StarRocks/starrocksproduct
- VulnCheck Advisory: StarRocks Query Detail Endpoint Returns Every User's Query Historythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.