What is the CVSS score of CVE-2026-80346?

CVE-2026-80346 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-80346?

Within 24 hours, audit all database user accounts and revoke unnecessary authentication credentials for non-administrative staff. Within 7 days, implement role-based access controls restricting DROP MATERIALIZED VIEW permissions to database administrators only, enable multi-factor authentication for all database accounts, and establish automated backups of materialized view definitions stored outside the primary database. Within 30 days, plan an upgrade to a patched StarRocks version when released by the vendor, implement change-approval workflows requiring administrator sign-off before DROP operations execute, and conduct database access training emphasizing least-privilege principles.

StarRocks CVE-2026-80346

EUVD-2026-66385 HIGH

Missing Authorization (CWE-862)

2026-08-26 VulnCheck

GHSA-97cx-wfjw-3m7v

Authentication Bypass Starrocks

7.1

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with any valid StarRocks account
Delivery

Enumerate or infer legacy synchronous materialized view names
Exploit

Issue DROP MATERIALIZED VIEW targeting any database
Execution

Authorization check bypassed by early return in AuthorizerStmtVisitor
Persist

AlterJobMgr permanently removes rollup index
Impact

Analytics pipelines and dependent queries disrupted

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Authentication is required - any valid StarRocks account qualifies (PR:L), with no specific role, grant on the target database, grant on the base table, or grant on the view needed. The target object must be a legacy synchronous materialized view, meaning it was created using the legacy `CREATE MATERIALIZED VIEW ... AS SELECT` syntax that stores the view as a rollup index on an `OlapTable`. Modern asynchronous materialized views created via the newer `CREATE MATERIALIZED VIEW ... REFRESH` syntax are NOT affected - they resolve to `MaterializedView` objects and traverse the correctly-gated code path. The attacker must know or successfully enumerate the name of at least one legacy synchronous materialized view in the deployment. No non-default configuration is required beyond the existence of the legacy view type. Exploitation is limited to environments that actually use legacy synchronous materialized views; environments using only asynchronous materialized views are not exposed to this specific flaw.
Impact	The CVSS 4.0 score of 7.1 accurately reflects a meaningful but bounded risk: the attack is network-reachable (AV:N), low-complexity (AC:L), requires only a valid login (PR:L), and produces high integrity impact (VI:H) through permanent view deletion, with low availability impact (VA:L) from disrupted query plans. There is no confidentiality impact. No CISA KEV listing and no known public exploit code exist at time of analysis, so this is not a confirmed active-exploitation scenario. The practical risk is highest in multi-tenant StarRocks deployments where access control between tenants is an enforced security boundary - even a small analytics team sharing a cluster with untrusted accounts should treat this as requiring prompt remediation, since any authenticated user can silently sabotage another tenant's analytics infrastructure without leaving distinguishable traces. EPSS data is absent from the provided intelligence, but the low exploitation complexity suggests the probability of opportunistic exploitation would be non-trivial once the flaw becomes more widely known.
Exploit ScenarioDerived	An authenticated StarRocks analyst account with no grants on a target database issues a `DROP MATERIALIZED VIEW dbname.mv_name` statement naming a known or enumerated legacy synchronous materialized view. The FE routes the statement through `AuthorizerStmtVisitor`, which exits immediately without an authorization call for legacy views, and `AlterJobMgr` completes the drop - permanently removing the rollup index and invalidating downstream query plans - with no audit distinction from an authorized drop. No public exploit code is required; a standard StarRocks client and valid credentials are sufficient.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 26, 2026

Missing authorization on DROP MATERIALIZED VIEW in StarRocks allows any authenticated account to permanently delete legacy synchronous materialized views across all databases, regardless of grants. The flaw exists because AuthorizerStmtVisitor.visitDropMaterializedViewStatement exits early without invoking the Authorizer; the authorization branch executes only when the resolved object is a modern MaterializedView, not when it is a legacy synchronous view stored as a rollup index on an OlapTable. Versions through 4.0.13 are affected per the VulnCheck advisory, and no public exploit has been identified at time of analysis.

RemediationAI

No vendor-released patched version has been independently confirmed at time of analysis. The CVE source code references point to the 3.5.19 branch of the StarRocks repository, suggesting development-branch fixes may exist, but a tagged release with this fix confirmed is not established from available data. Operators should monitor GitHub issue #76566 (https://github.com/StarRocks/starrocks/issues/76566) and StarRocks release notes for a confirmed patched version. As an immediate compensating control, restrict StarRocks FE authentication strictly to accounts that require DDL access, removing login access from read-only or analyst accounts that have no business need to issue DROP statements. Additionally, audit all legacy synchronous materialized views in use and consider migrating them to asynchronous materialized views, which traverse the correctly-gated authorization path. Note that access restriction reduces blast radius but does not eliminate the flaw - any account that legitimately needs authentication retains the ability to exploit this until a code-level fix is applied.

Affected VersionsENISA

StarRocks 0 ≤4.0.13

Affected Packages

euvd starrocks no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

StarRocks is a distributed OLAP database whose Java-based frontend (FE) enforces DDL privileges through an AuthorizerStmtVisitor using a visitor pattern: each statement type calls the appropriate Authorizer.checkXxxAction method before execution logic runs. Legacy synchronous materialized views deviate from modern asynchronous materialized views architecturally - they are stored as rollup indexes on OlapTable rather than as standalone MaterializedView objects. When DROP MATERIALIZED VIEW reaches LocalMetastore.dropMaterializedView, a branch on the resolved table type determines which path runs: the MaterializedView branch calls Authorizer.checkMaterializedViewAction, while the OlapTable branch proceeds directly to AlterJobMgr.processDropMaterializedView and then MaterializedViewHandler, neither of which contains any Authorizer call. CWE-862 (Missing Authorization) precisely describes the root cause: a security-sensitive operation - permanent deletion of a database object - executes without any access control gate on one code path. The affected classes are AuthorizerStmtVisitor.java and AlterJobMgr.java, referenced at the 3.5.19 source branch.

Know when Starrocks gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

vuln.today AI 7.1 HIGH

Network-reachable FE requires only a valid login (PR:L); no confidentiality loss; high integrity impact from permanent view deletion; low availability from disrupted queries.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.

Executive ViewAI

Why It Matters

StarRocks versions through 4.0.13 contain an authorization bypass that allows any authenticated database user to permanently delete materialized views across all databases, creating risk of data loss and application failures. Organizations using affected versions face immediate operational impact from both internal personnel and external threat actors who obtain database credentials.

Business Impact: High

Compensating Controls

Restrict database user privileges to minimum required; apply role-based access control (RBAC) to DROP MATERIALIZED VIEW operations; enable database audit logging for all DROP statements and connection events; maintain offline backups of materialized view schemas and metadata; implement network firewall rules limiting database access to trusted internal networks only.

Threat Intelligence Overview

EPSS Score

0.4%

Top 68% exploitable

Prevalence

Medium

widely used open-source OLAP database in enterprise analytics stacks

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.