---
id: CVE-2026-82306
title: >-
  StarRocks through 4.0.13 contains an information disclosure vulnerability in
  the query_detail endpoint that returns unfiltered query history for all users
summary: >-
  StarRocks through 4.0.13 contains an information disclosure vulnerability in
  the query_detail endpoint that returns unfiltered query history for all users.
  Authenticated attackers with low privileges can access full SQL text,
  execution p…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
published: '2026-08-28'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:46.123'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82306'
references:
  - url: 'https://github.com/StarRocks/starrocks'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/QueryDetailAction.java
    label: disclosure@vulncheck.com
  - url: 'https://github.com/StarRocks/starrocks/issues/75747'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/starrocks-query-detail-endpoint-returns-every-user-s-query-history
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00315
epssPercentile: 0.24705
ingestedAt: '2026-09-23T17:28:14.817Z'
vendor: StarRocks
product: starrocks
affected:
  - starrocks <= 4.0.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-31T16:23:26.884554Z'
---

## Overview

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.