StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of… (CVE-2026-82276)

StarRocks through version 4.0.13 contains an authentication bypass vulnerability (CVE-2026-82276) due to improper implementation of REST handler classes. Specifically, five REST handlers override the execute() method directly rather than implementing executeWithoutPassword(), which leads to six endpoints being accessible without authentication on the frontend HTTP port. These endpoints disclose sensitive information such as cluster topology, database metadata, JVM statistics, and version details. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). No known exploits are reported in the wild, and no patch or remediation information is currently provided.

Attackers can access sensitive information about the StarRocks cluster, including topology, database metadata, JVM statistics, and version information, without authentication. This information disclosure could aid attackers in further reconnaissance but does not directly allow modification or denial of service. The CVSS score of 5.3 reflects a moderate impact primarily due to confidentiality loss without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the frontend HTTP port to trusted networks only to reduce exposure. Monitor for updates from StarRocks regarding patches or official mitigations.