CVE-2026-82306

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82306
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82306.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82306
Published
2026-08-28T16:19:08Z
Modified
2026-09-02T08:08:00Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
StarRocks Query Detail Endpoint Returns Every User's Query History
Details

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82306.json"
}
References

Affected packages

Git / github.com/starrocks/starrocks

Affected ranges

Type
GIT
Repo
https://github.com/starrocks/starrocks
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b55eab7ab5fcce229daa844a94e53982fd23285a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.13"
        },
        {
            "fixed": "4.0.13"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

2.*
2.2.0-alpha
2.3.0-main-funnel
2.4.0-alpha
2.4.0-llzf0802
2.5.0-xiaohongshu
3.*
3.1.0-kakao-0606
Other
main-20230609
test-allin1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82306.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "232384986394970485028977516002479225541",
                "212046568731993588657194765297199632618",
                "32081562229677316359807567668936447761",
                "120444124193156190839231877465163316921"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82306-186831a6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/starrocks/starrocks/commit/b55eab7ab5fcce229daa844a94e53982fd23285a",
        "target": {
            "file": "fe/fe-core/src/main/java/com/starrocks/connector/iceberg/IcebergMetadata.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "150535171851586148762105943979551273580",
            "length": 2164
        },
        "id": "CVE-2026-82306-407496ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/starrocks/starrocks/commit/b55eab7ab5fcce229daa844a94e53982fd23285a",
        "target": {
            "file": "fe/fe-core/src/main/java/com/starrocks/connector/iceberg/IcebergMetadata.java",
            "function": "finishSink"
        }
    }
]
vanir_signatures_modified 
"2026-09-02T08:08:00Z"