CVE-2026-82306

MEDIUM 6.5

StarRocks Query Detail Endpoint Returns Every User's Query History

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

CWE	CWE-200
Vendor	starrocks
Product	starrocks
Published	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for starrocks starrocks

Be the first to know when new medium vulnerabilities affecting starrocks starrocks are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

StarRocks / starrocks

0 ≤ 4.0.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/StarRocks/starrocks/issues/75747 github.com: https://github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/QueryDetailAction.java github.com: https://github.com/StarRocks/starrocks vulncheck.com: https://www.vulncheck.com/advisories/starrocks-query-detail-endpoint-returns-every-user-s-query-history

Credits

🔍 George Chen