Description

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:20:20.947Z",
  "pubdate": "2026-08-28T20:20:20.947Z",
  "executiveSummary": "StarRocks versions through 4.0.13 are susceptible to an information disclosure vulnerability located within the query_detail endpoint.\nThe vulnerability involves an improper authorization check that allows authenticated users with low-level privileges to retrieve sensitive, unfiltered query history records belonging to all users across the cluster.\nThis flaw exposes critical data including complete SQL query strings, execution plans, and performance profiling metadata.\nThe risk is severe as sensitive queries often contain hardcoded credentials, personal identifiable information (PII), or proprietary business logic, which can be harvested by malicious actors to escalate privileges or exfiltrate organizational data.\nSuccessful exploitation requires minimal effort, as an attacker only needs valid, low-privileged credentials to interact with the management API.\nNo complex attack chains or administrative permissions are necessary to bypass the intended access controls, effectively allowing non-privileged users to bypass systemic security boundaries and access the entire history of system-wide operations.",
  "technicalDetails": "The vulnerability resides in the implementation of the query_detail API endpoint within StarRocks versions 4.0.13 and earlier. The root cause is a failure in the server-side access control logic, which does not properly validate that a requester has the necessary administrative or ownership permissions before serving query diagnostic data.\nUnder normal operating conditions, this endpoint is intended to provide administrators with visibility into system performance and troubleshooting metrics. However, due to the missing authorization scope, the backend fails to apply a filter based on the requester's identity, causing the system to serialize and return the full global query history buffer.\nThe attack flow proceeds as follows: First, the attacker establishes an authenticated session with the StarRocks cluster using legitimate, low-privileged credentials. Second, the attacker issues an HTTP GET request to the query_detail endpoint. Because the application logic lacks an attribute-based access control (ABAC) or role-based access control (RBAC) check against the query metadata before response generation, the server retrieves all records stored in the internal query cache.\nThe returned payload typically includes high-fidelity diagnostic data: raw SQL statements submitted by other users, which may inadvertently contain plaintext passwords, API keys, or sensitive connection strings; full query execution plans, which map out the structure and tables of the database; and detailed performance profiling data that reveals internal system architecture.\nThe impact of this disclosure is broad. Beyond the immediate loss of confidentiality regarding user activity, the exposure of execution plans assists an attacker in mapping the database schema, identifying sensitive table names, and discovering optimization patterns that could be exploited for further attacks, such as SQL injection or blind data exfiltration. The presence of credentials within historical SQL strings provides an immediate path to lateral movement or vertical privilege escalation, as the attacker can reuse captured credentials to assume the identity of more privileged users or application service accounts.\nThe vulnerability is exposed through the standard management interface, meaning any network segment that can reach the StarRocks API is a potential vector for exploitation. Given that the query history is a persistent log within the database management system, the attacker can aggregate this information over time to gain a comprehensive view of organizational data access patterns."
}