Description

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T20:20:18.640Z",
  "pubdate": "2026-08-28T20:20:18.640Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified in StarRocks versions through 4.0.13, stemming from improper implementation of REST handler security mechanisms.\nThe vulnerability affects five specific REST handler classes, allowing unauthorized actors to access six distinct unauthenticated endpoints on the frontend HTTP port.\nSuccessful exploitation enables the disclosure of sensitive system information, including cluster topology, internal database metadata, JVM operational statistics, and versioning details.\nThis flaw presents a significant security risk, as it permits unauthenticated reconnaissance of the database environment without requiring valid credentials.\nThe impact is characterized by unauthorized information disclosure, which facilitates advanced persistent threats and provides attackers with the necessary context to orchestrate further exploitation against the infrastructure.",
  "technicalDetails": "The vulnerability originates from a flaw in the application's REST request handling architecture within the StarRocks frontend HTTP server.\nIn StarRocks, security policies typically mandate that REST handlers override the executeWithoutPassword() method to permit anonymous access, whereas sensitive operations must rely on the execute() method, which enforces authentication checks.\nThe root cause of this vulnerability is that five REST handler classes improperly override the execute() method directly instead of utilizing the secure executeWithoutPassword() interface.\nBy bypassing the mandatory authentication verification logic normally triggered within the base handler classes, these handlers inadvertently expose functionality that was intended to be protected.\nAttackers can exploit this by sending crafted HTTP requests to the frontend HTTP port for the six impacted endpoints.\nThe attack flow proceeds as follows: 1) The attacker targets the frontend HTTP service; 2) The request is routed to one of the five misconfigured REST handlers; 3) The handler executes its logic immediately without invoking the requisite credential validation sequence; 4) The server responds with internal system data.\nThe scope of information leaked is comprehensive, encompassing critical system artifacts such as cluster topology, database metadata, detailed JVM heap and thread statistics, and version-specific information.\nThis allows an attacker to conduct a full internal reconnaissance of the StarRocks cluster architecture remotely, which is a precursor to more severe attacks such as privilege escalation or data exfiltration.\nBecause the authentication check is omitted at the code level, there are no privilege requirements, and the vulnerability is accessible to any user capable of reaching the StarRocks frontend HTTP service over the network.\nThe vulnerability affects all versions of StarRocks up to and including 4.0.13, necessitating a review of the handler implementation patterns for these specific endpoints."
}