Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-82276StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

Medium 5.3

In plain English

A medium-severity missing authentication in starrocks from StarRocks. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 55.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.

Affected products (as reported)

Vendor	Product	Versions
StarRocks	starrocks	0 – through 4.0.13

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Issue #75747 issue-tracking
https://github.com/StarRocks/starrocks product
Authentication gate: RestBaseAction.java technical-description
Vulnerable code: ShowMetaInfoAction.java technical-description
VulnCheck Advisory: StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate third-party-advisory