Medium severity5.3NVD Advisory· Published Aug 28, 2026
CVE-2026-82276
CVE-2026-82276
Description
StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/RestBaseAction.javanvd
- github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/ShowMetaInfoAction.javanvd
- github.com/StarRocks/starrocks/issues/75747nvd
- www.vulncheck.com/advisories/starrocks-frontend-rest-handlers-bypass-the-base-class-authentication-gatenvd
News mentions
0No linked articles in our index yet.