EUVD-2026-66385

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

CVE-2026-82306

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

CVE-2026-82276

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82306 StarRocks Query Detail Endpoint Returns Every User's Query History

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

CVE-2026-82306 StarRocks Query Detail Endpoint Returns Every User's Query History

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

EUVD-2026-67823

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

CVE-2026-82306

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint, which returns unfiltered query history for all users rather than scoping results to the requesting user. An authenticated attacker with low privileges can thereby retrieve the full SQL text , e...

CVE-2026-82306 StarRocks Query Detail Endpoint Returns Every User's Query History

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82276

StarRocks through 4.0.13 contains an authentication bypass in the Frontend (FE) where five REST handler classes override execute() directly instead of implementing executeWithoutPassword(), thereby bypassing the base class authentication gate. As a result, six unauthenticated endpoints on the fro...

EUVD-2026-67807

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82306: Exposure of Sensitive Information to an Unauthorized Actor

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

CVE-2026-82276: Missing Authentication for Critical Function

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

PT-2026-83315

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

PT-2026-83299

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-80346

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

CVE-2026-80346 StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

CVE-2026-80346

StarRocks through 4.0.13 has a missing authorization vulnerability in the DROP MATERIALIZED VIEW code path for legacy synchronous materialized views. When such a view is dropped, the statement visitor returns without invoking the Authorizer , and the execution logic that should perform the check ...