THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-80346 (HIGH 7.1) — StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating

[NVD] CVE-2026-80346 (HIGH 7.1) — StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating

mednvdPublished 2026-08-26

CVE-2026-80346 CVSS: 7.1 HIGH Published: 2026-08-26T10:16:42.637

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only

Indicators of compromise

CVE-2026-80346cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-80346