CVE-2026-82306CWE-200information-disclosure

CVE-2026-82306

Medium · published August 29, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-29T00:20Z
References (4)
https://github.com/StarRocks/starrocks · [email protected]https://github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/QueryDetailAction.java · [email protected]https://github.com/StarRocks/starrocks/issues/75747 · [email protected]https://www.vulncheck.com/advisories/starrocks-query-detail-endpoint-returns-every-user-s-query-history · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:19Z
    StarRocks Query Detail Endpoint Returns Every User's Query History
    cvelistv5