Quick answers
- Is CVE-2026-82306 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82306 being exploited in the wild.
- How severe is CVE-2026-82306?
- Medium severity, with a CVSS score of 6.5, published 28 August 2026.
- Which products and versions are affected?
- StarRocks through 4.0.13.
- Is there a fix for CVE-2026-82306?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82306 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82306?
- Check whether you run StarRocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The query_detail endpoint in StarRocks through version 4.0.13 fails to properly filter query history by user authorization, resulting in unauthorized information disclosure. The vulnerable component is located in the Java REST API handler (QueryDetailAction.java) of the frontend service. An authenticated attacker with low-privilege database credentials can send HTTP requests to this endpoint and retrieve unfiltered query details across all users in the system. The attack requires valid authentication (low-privilege account) and network access to the StarRocks HTTP API interface. An attacker can extract full SQL statements, query plans, and performance metrics from other users' queries, potentially revealing embedded credentials or sensitive business logic.
Affected products
- StarRocks StarRocks through 4.0.13
Timeline
- 2026-08-28: disclosed