CVE-2026-82276

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82276
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82276.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82276
Published
2026-08-28T16:18:57.611Z
Modified
2026-09-02T03:47:27.987085493Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate
Details

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82276.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-306"
    ]
}
References

Affected packages

Git / github.com/starrocks/starrocks

Affected ranges

Type
GIT
Repo
https://github.com/starrocks/starrocks
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b55eab7ab5fcce229daa844a94e53982fd23285a
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.13"
        },
        {
            "fixed": "4.0.13"
        }
    ]
}

Affected versions

2.*
2.2.0-alpha
2.3.0-main-funnel
2.4.0-alpha
2.4.0-llzf0802
2.5.0-xiaohongshu
3.*
3.1.0-kakao-0606
Other
main-20230609
test-allin1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82276.json"