CVE-2026-82276
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.
Risk Assessment
An unauthenticated attacker could obtain sensitive infrastructure information, potentially facilitating further attacks and compromising system security.
Recommendation
Update StarRocks to a version that fixes the authentication bypass. Restrict access to the frontend HTTP port and monitor unauthorized requests.
Other vulnerabilities in StarRocks
Original NVD description (English source)
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.