Executive brief
StarRocks is an open-source analytics database engine used for real-time and sub-second analytics queries. A vulnerability in the query_detail API endpoint allows authenticated users with low privileges to view complete query history—including SQL text, execution plans, and profiling data—from other users, potentially exposing sensitive information like database credentials embedded in queries.
Technical details
The query_detail endpoint in StarRocks through version 4.0.13 fails to properly filter query history by user authorization, resulting in unauthorized information disclosure. The vulnerable component is located in the Java REST API handler (QueryDetailAction.java) of the frontend service. An authenticated attacker with low-privilege database credentials can send HTTP requests to this endpoint and retrieve unfiltered query details across all users in the system. The attack requires valid authentication (low-privilege account) and network access to the StarRocks HTTP API interface. An attacker can extract full SQL statements, query plans, and performance metrics from other users' queries, potentially revealing embedded credentials or sensitive business logic.
Affected products
- StarRocks StarRocks through 4.0.13
Timeline
- 2026-08-28: disclosed