Description
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.
Published: 2026-08-28
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

StarRocks 4.0.13 and earlier expose unfiltered query history via the query_detail endpoint. An authenticated user with low privileges can retrieve complete SQL text, execution plans, and profiling data for every query run by other users, potentially revealing sensitive credentials. This information disclosure flaw (CWE‑200) compromises confidentiality and can lead to credential theft and further attacks.

Affected Systems

The affected product is StarRocks. Versions through 4.0.13 are vulnerable; any installation running these releases is at risk. The flaw exists in the Front End component, specifically the QueryDetailAction handler.

Risk and Exploitability

The CVSS score of 6.5 denotes a medium to high severity vulnerability. EPSS is not available, so the current probability of exploitation is unknown; however, the flaw is accessible to any authenticated user, which lowers the barrier to attack. The vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation evidence yet, but the impact warrants prompt remediations.

Generated by OpenCVE AI on August 28, 2026 at 22:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to StarRocks 4.0.14 or later to patch the issue.
  • Restrict the query_detail endpoint by removing it from the API or limiting access to privileged users if an upgrade is not immediately feasible.
  • Apply network controls to block external exposure of the query_detail endpoint and monitor for unauthorized query history requests.

Generated by OpenCVE AI on August 28, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Starrocks
Starrocks starrocks
Vendors & Products Starrocks
Starrocks starrocks

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.
Title StarRocks Query Detail Endpoint Returns Every User's Query History
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Starrocks Starrocks
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-31T18:54:41.650Z

Reserved: 2026-08-28T12:14:57.815Z

Link: CVE-2026-82306

cve-icon Vulnrichment

Updated: 2026-08-31T16:23:28.093Z

cve-icon NVD

Status : Received

Published: 2026-08-28T20:20:20.947

Modified: 2026-08-31T19:17:18.527

Link: CVE-2026-82306

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T11:20:22Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor