CVE-2026-82306

6.5 Moyenne

Publiée le 28/08/2026 à 22:20 · Modifiée le 23/09/2026 à 19:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

Traduire en français

Produits concernés

starrocks

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-200

Références

https://github.com/StarRocks/starrocks
https://github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/QueryDetailAction.java
https://github.com/StarRocks/starrocks/issues/75747
https://www.vulncheck.com/advisories/starrocks-query-detail-endpoint-returns-every-user-s-query-history

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories