CVE-2026-82306 - StarRocks Query Detail Endpoint Vulnerability

CVE-2026-82306 - StarRocks Query Detail Endpoint Vulnerability

CVE-2026-82306: The StarRocks Query Detail Endpoint is vulnerable and returns every user’s query history. This is a MEDIUM severity vulnerability with a CVSS 3.1 score of 6.5. 🚨

The detailed analysis reveals that StarRocks, through version 4.0.13, contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials. 🔑

Severity Assessment

The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing the severity of vulnerabilities in software and systems. The CVSS 3.1 score for this vulnerability is 6.5, indicating a MEDIUM severity, with an Exploitability Score of 2.8 and an Impact Score of 3.6.

Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. Notably, CVE-2026-82306 is associated with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Furthermore, Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which describe the common attributes and approaches employed by adversaries to exploit the CVE-2026-82306 weaknesses.

Mitigation Strategies

To mitigate this information disclosure vulnerability, organizations should:

• Restrict access to query history.
• Update StarRocks to a patched version.
• Apply vendor patches for StarRocks.
• Limit privileges for authenticated users.
• Review and audit query logs.

For more details, you can read the complete article here: Read full article