StarRocks EUVD-2026-67807

No special configuration or feature flag is required for exploitation - the six vulnerable endpoints are present and unauthenticated in every default StarRocks deployment through 4.0.13, because the authentication bypass is a code-level defect in the handler class hierarchy rather than a configuration option. Exploitation requires only network reachability to the StarRocks frontend HTTP port (default TCP 8030). The primary limiting factor is network exposure: deployments where the FE HTTP port is firewalled to internal or trusted networks only are not directly exploitable by external attackers, though the vulnerability remains accessible to any host with internal port reachability. Impact is strictly limited to information disclosure - the exposed endpoints provide no write capability, code execution, or access to stored row data.

The provided CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N is well-calibrated: exploitation is trivially simple over any network path to the FE HTTP port, but impact is bounded to metadata disclosure rather than stored data exfiltration or code execution. No EPSS score was provided in the source intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public POC code is referenced. Despite the moderate CVSS score, the practical risk is higher than the number implies for data-intensive deployments: version string disclosure enables targeted CVE matching, cluster topology reveals FE and BE node addresses for further probing, and database metadata exposure aids schema-aware attack planning. Defenders operating StarRocks instances accessible beyond a strictly internal network segment should treat patching as a priority even in the absence of a KEV listing, since the barrier to exploitation is near-zero once the port is reachable. The CVSS signal and KEV signal are consistent here - there is no conflict between them.

An attacker with network access to the StarRocks frontend HTTP port sends a plain, unauthenticated HTTP GET request to one of the six exposed REST endpoints - no credentials, tokens, or special headers required. The response returns cluster node addresses, database and table names, JVM heap and garbage-collection statistics, and the exact StarRocks version string. The attacker uses the version string to match against published CVEs and the topology data to enumerate additional FE and BE nodes for further targeting.