CVE-2026-82276: StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
StarRocks Frontendto a version that resolves this vulnerability.Fixed in 4.0.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
StarRocks Frontend instances through 4.0.13 are affected if their frontend HTTP port is reachable by an attacker. No credentials or user interaction are required.
What information can an unauthenticated attacker obtain?
The affected REST endpoints can disclose cluster topology, database metadata, JVM statistics, and StarRocks version information. The reported impact is limited to information disclosure; integrity and availability impact are not indicated.
How can I determine whether my deployment is affected?
Check whether the StarRocks Frontend version is 4.0.13 or earlier and whether its HTTP port exposes the affected REST handlers to untrusted network clients. The issue affects five handler classes and six unauthenticated endpoints.