CVE-2026-82276 in StarRocks
Summary
by MITRE • 08/28/2026
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified security flaw resides within StarRocks versions up through 4.0.13, specifically affecting five REST handler classes that improperly override the execute method rather than implementing the intended executeWithoutPassword interface. This architectural deviation creates a critical authentication bypass vulnerability by allowing unauthenticated access to sensitive administrative endpoints exposed on the frontend HTTP port. The root cause lies in the failure of these specific handlers to enforce mandatory credential verification before processing requests, effectively leaving them open to any network actor capable of reaching the service.
This misconfiguration results in the exposure of six distinct unauthenticated endpoints that provide attackers with significant reconnaissance capabilities. By exploiting this flaw, an adversary can retrieve detailed cluster topology information, which reveals the internal structure and connectivity of the database infrastructure. Additionally, access is granted to sensitive database metadata, including schema definitions and table structures, as well as JVM statistics that expose memory usage and garbage collection details. The vulnerability also allows for the disclosure of precise version information, enabling attackers to correlate other known exploits with the specific software build in use.
The operational impact of this vulnerability extends beyond mere data leakage. Disclosure of cluster topology and database metadata facilitates advanced lateral movement planning by providing a map of the internal network architecture and critical data assets. Knowledge of JVM statistics can aid in crafting denial-of-service attacks tailored to resource exhaustion, while version disclosure allows for targeted exploitation using known vulnerabilities associated with that specific release. This situation represents a severe compromise of confidentiality within the system, undermining the security posture of any deployment relying on these unpatched versions.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, as the system fails to correctly verify identity before granting access. It also relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, due to the disclosure of internal metrics and metadata. In terms of offensive security frameworks, this activity corresponds to ATT&CK technique T1592, Gather Victim Host Information, where adversaries collect details about a target system to aid in further attacks.
Mitigation requires immediate patching to a version later than 4.0.13 where these handler classes have been corrected to properly implement executeWithoutPassword or enforce authentication checks. Organizations should also audit their network segmentation strategies to ensure that the frontend HTTP port is not directly exposed to untrusted networks without additional access controls such as firewalls or reverse proxies with strict IP whitelisting. Regular vulnerability scanning and configuration reviews are recommended to detect similar misconfigurations in other services running on the same infrastructure.