StarRocks CVE-2026-82306

Authentication as any valid StarRocks user with low privileges is required - exploitation is not unauthenticated. The CVSS vector PR:L confirms this. The vulnerable endpoint is the query_detail REST API served by the StarRocks Frontend (FE) service over HTTP; the FE HTTP port must be network-reachable from the attacker's position. No special configuration, non-default feature, or elevated role is needed beyond possessing any valid account. Exploitation is limited by the following factors: (1) an attacker must first obtain valid credentials for at least one StarRocks account; (2) the FE HTTP interface must be reachable from the attacker's network position; (3) the severity of credential exposure depends on whether other users' SQL statements actually contain sensitive secrets. In deployments where the FE REST port is internal-only and all SQL is parameterized without inline credentials, the practical impact is reduced to query-plan disclosure rather than direct credential theft.

The NVD-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the core risk profile: network-reachable, low complexity, but gated behind any valid low-privilege account. The high confidentiality impact is well-justified given that SQL history can contain embedded secrets. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified precisely, though the attack is trivially reproducible once authenticated - no special tooling is required beyond an HTTP client. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, suggesting no confirmed mass exploitation at time of analysis. Even so, the credential-exposure chain means that a low-privilege compromise of a StarRocks account can rapidly escalate to access to downstream systems referenced in stored queries. Organizations running multi-tenant or shared StarRocks clusters - whether a large enterprise data platform or a mid-sized analytics team - should treat this as a meaningful priority rather than a theoretical concern, given that the attack requires no special skill beyond valid credentials. No conflicting signals are present across the available data sources: the CVSS vector, description, and VulnCheck advisory are internally consistent.

An attacker who has obtained any valid StarRocks account - through phishing, credential stuffing, or a separate compromise - sends an HTTP GET request to the FE REST endpoint /api/query_detail. The response returns the unfiltered global query history for all users on the cluster, including full SQL text from other users' sessions. If those statements contain inline credentials (e.g., INSERT INTO … WITH PASSWORD='…' or connection string literals used in external table definitions), the attacker extracts them without requiring any elevated privileges or additional exploitation steps. No public proof-of-concept code has been identified, but the attack is mechanically trivial given knowledge of the endpoint.