EUVD-2026-67823
GHSA-j4pf-x6cj-4mjq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST endpoint, no complexity or user interaction; low privilege (any account) required; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.
AnalysisAI
StarRocks through version 4.0.13 exposes complete query history for all users to any authenticated low-privilege user via the unguarded query_detail REST endpoint. The endpoint returns full SQL text, execution plans, and profiling data without filtering by the requesting user's identity, meaning statements containing embedded credentials - connection strings, passwords passed as query parameters - are fully readable by any logged-in account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authentication as any valid StarRocks user with low privileges is required - exploitation is not unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the core risk profile: network-reachable, low complexity, but gated behind any valid low-privilege account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authorization on DROP MATERIALIZED VIEW in StarRocks allows any authenticated account to permanently delete lega
Unauthenticated access to six REST endpoints on StarRocks' frontend HTTP port allows remote attackers to enumerate clust
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today