CVE-2026-82306: StarRocks Information Disclosure Vulnerability

CVE-2026-82306 Overview

CVE-2026-82306 is an information disclosure vulnerability in StarRocks through version 4.0.13. The query_detail HTTP endpoint returns unfiltered query history for all users on the cluster. Any authenticated account with low privileges can retrieve the full SQL text, execution plans, and profiling data submitted by other users. This includes statements that embed credentials, tokens, or sensitive business data in query strings. The flaw is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privileged authenticated users can harvest credentials and sensitive data from every SQL query executed across the StarRocks cluster.

Affected Products

StarRocks versions up to and including 4.0.13
StarRocks Frontend (FE) HTTP REST service
Deployments exposing the QueryDetailAction endpoint

Discovery Timeline

2026-08-28 - CVE-2026-82306 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82306

Vulnerability Analysis

StarRocks exposes an administrative HTTP endpoint named query_detail that returns metadata about executed queries. The endpoint is implemented in QueryDetailAction.java inside the frontend (FE) module. It responds with query history entries containing the full SQL text, execution plan, and runtime profiling data.

The endpoint enforces authentication but omits per-user filtering. A caller who successfully authenticates receives the query history of every other user on the system. Attackers can mine returned SQL text for embedded credentials such as IDENTIFIED BY '<password>' clauses, CREATE USER statements, cloud storage keys passed to LOAD statements, and API tokens used in external table definitions.

Because query profiles include timing and row-count data, an attacker also gains reconnaissance value: table names, schema structure, and business logic patterns become visible without any SELECT privilege on the underlying tables.

Root Cause

The root cause is missing authorization at the response-filtering layer. QueryDetailAction treats query history as a single global resource rather than a per-principal collection. The handler validates that the caller is authenticated but does not compare the requesting user against the user field of each QueryDetail record before serializing it into the response.

Attack Vector

Exploitation requires network access to the StarRocks FE HTTP port and any valid low-privileged account. The attacker issues an HTTP GET request to the query_detail endpoint with a chosen time-window parameter. The server returns JSON containing every recorded query. Refer to GitHub Issue #75747 and the VulnCheck Security Advisory for technical details.

// No verified public exploit code is available.
// See the VulnCheck advisory and StarRocks issue #75747 for reproduction details.

Detection Methods for CVE-2026-82306

Indicators of Compromise

HTTP GET requests to the FE endpoint path /api/query_detail from non-administrative accounts.
Repeated query_detail requests from a single source IP scanning multiple time-window ranges.
Unexpected authentications from service or reporting accounts followed by REST API calls to FE management endpoints.

Detection Strategies

Enable HTTP access logging on the StarRocks FE and alert on any access to /api/query_detail outside of an approved administrator allowlist.
Correlate FE audit logs with identity provider logs to identify low-privileged users invoking administrative REST endpoints.
Baseline normal query volume per user and flag accounts that suddenly retrieve large JSON payloads from the FE HTTP interface.

Monitoring Recommendations

Forward StarRocks FE fe.audit.log and HTTP access logs to a centralized SIEM for retention and query.
Monitor egress traffic from database analyst workstations for large outbound transfers following FE REST API interaction.
Rotate any credentials that may have appeared in historical SQL statements after confirming the endpoint was reachable.

How to Mitigate CVE-2026-82306

Immediate Actions Required

Restrict network access to the StarRocks FE HTTP port so only trusted administrative hosts can reach the REST API.
Audit all StarRocks user accounts and remove or disable any that are unused or over-privileged.
Review recent SQL activity for statements containing plaintext credentials and rotate the exposed secrets.
Track the fix in the StarRocks GitHub repository and apply the patched release once available.

Patch Information

At the time of publication, StarRocks 4.0.13 is the latest affected version and no fixed release is referenced in the NVD entry. Monitor GitHub Issue #75747 and upstream release notes for the remediation commit that adds per-user filtering to QueryDetailAction.

Workarounds

Place the FE HTTP port behind a reverse proxy or firewall rule that blocks /api/query_detail for non-administrative source addresses.
Avoid embedding credentials directly in SQL statements; use StarRocks resource objects or externally managed secrets instead.
Require multi-factor authentication and short-lived credentials for all StarRocks accounts to reduce the value of any leaked query text.

bash

# Example nginx rule to block query_detail from non-admin subnets
location /api/query_detail {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://starrocks_fe_backend;
}