Authentication Bypass in StarRocks REST Handlers

Executive Summary

CVE-2026-82276 is an authentication bypass vulnerability in StarRocks versions up to 4.0.13. Five REST handler classes override the execute() method directly instead of using executeWithoutPassword(), allowing unauthenticated access to six endpoints. Attackers can retrieve sensitive cluster information like topology, database metadata, JVM stats, and version details without credentials.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to StarRocks REST endpoints like /api/show_meta_info, /api/show_data, or /api/query_detail. Use network monitoring tools to inspect HTTP requests to the frontend port for unauthenticated GET requests to these paths. Verify if sensitive metadata like cluster topology or JVM stats is exposed without credentials.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can access sensitive cluster data, including master/follower IPs, database sizes, JVM memory stats, and enabled features. This exposes internal system details that could aid further attacks or data exfiltration. The impact is limited to information disclosure as no data modification or deletion is possible.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade StarRocks to a patched version where affected REST handlers use executeWithoutPassword() instead of overriding execute(). Restrict network access to the frontend HTTP port. Monitor logs for suspicious access to /api/show_meta_info, /api/show_data, or /api/query_detail endpoints.

Useful 0 Not Useful 0