CVE-2026-80346: StarRocks Privilege Escalation Vulnerability

CVE-2026-80346 Overview

CVE-2026-80346 is a missing authorization vulnerability [CWE-862] in StarRocks that allows any authenticated user to drop legacy synchronous materialized views without holding any privilege on the view, the base table, or the database. The flaw resides in the AuthorizerStmtVisitor.visitDropMaterializedViewStatement code path, which delegates the privilege check to execution logic that never runs for legacy synchronous materialized views stored as rollup indexes on OlapTable objects. The vulnerability affects StarRocks releases through 4.0.13.

Critical Impact
Any authenticated StarRocks account can drop legacy synchronous materialized views across any database, causing integrity loss that is indistinguishable from an authorized deletion.

Affected Products

StarRocks releases through 4.0.13
StarRocks 3.5.x branch (including 3.5.19 referenced in the advisory)
Deployments using legacy synchronous materialized views backed by rollup indexes

Discovery Timeline

2026-08-26 - CVE-2026-80346 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80346

Vulnerability Analysis

StarRocks routes SQL statements through AuthorizerStmtVisitor so that each statement type invokes the Authorizer before execution. The visitDropMaterializedViewStatement method breaks this pattern. It returns immediately with a comment claiming the privilege check occurs in execution logic. That contract holds only for asynchronous materialized views.

Asynchronous views resolve to a MaterializedView object and trigger LocalMetastore.dropMaterializedView, which calls Authorizer.checkMaterializedViewAction. Legacy synchronous materialized views are stored as rollup indexes on an OlapTable rather than as a MaterializedView object. The OlapTable branch reaches AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which invokes the Authorizer.

The drop path scans every OlapTable in the named database for a matching rollup index and validates only table state and name conflicts. The resulting drop leaves no signal that distinguishes it from an authorized operation.

Root Cause

The root cause is a split code path where authorization enforcement was implemented for one materialized view representation but omitted for the legacy rollup-index representation. AuthorizerStmtVisitor relies on downstream execution to enforce access control, and the legacy branch never performs that check.

Attack Vector

An attacker needs only a valid StarRocks account with network access to the frontend service. The attacker issues a DROP MATERIALIZED VIEW statement targeting a legacy synchronous materialized view by name. The frontend resolves the target across databases without verifying grants, and the operation completes as if authorized.

The vulnerability mechanism is described in the VulnCheck Security Advisory and in GitHub Issue #76566. Source references are available in the StarRocks Repository and specifically in AuthorizerStmtVisitor.java and AlterJobMgr.java.

Detection Methods for CVE-2026-80346

Indicators of Compromise

Audit log entries showing DROP MATERIALIZED VIEW statements executed by accounts without documented grants on the referenced database or base table.
Unexpected disappearance of legacy synchronous materialized views or rollup indexes on OlapTable objects.
Query performance regressions caused by the loss of a rollup index that queries previously routed through.

Detection Strategies

Compare current materialized view inventory against a known-good baseline to detect deletions that lack a corresponding change ticket.
Correlate StarRocks frontend audit logs with the account's grant map to flag drops issued by accounts holding no privilege on the target.
Alert on AlterJobMgr.processDropMaterializedView execution paths in frontend logs where the caller is not an administrator.

Monitoring Recommendations

Forward StarRocks frontend audit logs to a centralized SIEM and retain DDL statements for extended review.
Track privileged DDL operations, especially DROP statements against materialized views and rollup indexes, and route anomalies to the SOC.
Baseline the set of accounts authorized to perform schema changes and generate alerts when other accounts issue schema-modifying statements.

How to Mitigate CVE-2026-80346

Immediate Actions Required

Inventory legacy synchronous materialized views and record ownership so unauthorized drops can be recognized quickly.
Restrict which accounts can authenticate to the StarRocks frontend, and rotate credentials for shared or service accounts.
Enable and centralize frontend audit logging to capture every DROP MATERIALIZED VIEW statement with the executing user identity.

Patch Information

At time of publication, the advisory identifies StarRocks through 4.0.13 as affected. Monitor the StarRocks GitHub repository and Issue #76566 for a fixed release, then upgrade all frontend and backend nodes. Validate after upgrade that visitDropMaterializedViewStatement invokes Authorizer.checkMaterializedViewAction for both MaterializedView and OlapTable rollup-index code paths.

Workarounds

Migrate legacy synchronous materialized views to asynchronous materialized views, which route through LocalMetastore.dropMaterializedView and receive an authorization check.
Limit StarRocks account provisioning to trusted users until a patched release is deployed, and remove unused accounts.
Place the StarRocks frontend behind a network policy that permits access only from authorized application hosts and administrator workstations.

bash

# Configuration example: audit accounts and revoke unnecessary access
SHOW GRANTS FOR ALL;
REVOKE ALL ON DATABASE <db_name> FROM '<untrusted_user>';
DROP USER '<unused_account>';