StarRocks versions through 4.0.13 contain an authentication bypass in five REST handler classes that bypass the base class authentication checks by overriding execute() instead of using executeWithoutPassword(). This flaw allows any user to hit six specific endpoints on the frontend HTTP port without credentials and obtain details such as cluster topology, database metadata, JVM statistics, and version information. The flaw is classified as CWE‑306 and is rated with a CVSS score of 5.3, indicating a moderate severity for an information‑disclosure vulnerability.

The affected product is StarRocks, specifically the frontend component of v4.0.13 and older releases. The six vulnerable endpoints are exposed on the standard frontend HTTP port and are reachable by any host that can reach that port, regardless of authentication.

The lack of authentication means attackers can exploit the issue remotely over HTTP once they have network reach to the frontend service. While the flaw does not provide code execution or privileged manipulation, the information disclosed could aid future attacks or facilitate further reconnaissance. EPSS information is not available, but the moderate CVSS score suggests a realistic exploitation likelihood if the target’s frontend port is exposed. The vulnerability is not listed in the CISA KEV catalog, but any publicly reachable instance should be treated as high risk until mitigated.