CVE-2026-27315 Apache Cassandra: cqlsh history sensitive information leak

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via /.cassandra/cqlshhistory local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description:...

CVE-2026-27315

CVE-2026-27315 affects Apache Cassandra 4.0 and its cqlsh history mechanism. The issue allows a local attacker to access sensitive data by reading the ~/.cassandra/cqlsh_history file, where command history can contain passwords and other secrets in cleartext if entered during cqlsh sessions. The ...

CVE-2026-27315

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via /.cassandra/cqlshhistory local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description:...

CVE-2026-27315 Apache Cassandra: cqlsh history sensitive information leak

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via /.cassandra/cqlshhistory local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description:...

CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are...

CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are...

CVE-2026-27314

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are...

CVE-2026-27314

CVE-2026-27314 affects Apache Cassandra 5.0 in an mTLS environment using MutualTlsAuthenticator. A user with only CREATE permission can bind their certificate identity to an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY . The root cause is an authoriza...

CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are...

PT-2026-30916

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue...

Apache Cassandra 安全漏洞

Apache Cassandra is a distributed NoSQL database developed by the Apache Foundation in the United States. There are security vulnerabilities in Apache Cassandra versions 4.0, 4.1, and 5.0. These vulnerabilities allow authenticated users to increase query latency by repeatedly changing passwords,...

Apache Cassandra 安全漏洞

Apache Cassandra is a distributed NOSQL database developed by the Apache Foundation in the United States. Version 5.0 of Apache Cassandra contains a security vulnerability. This vulnerability stems from improper permission allocation when using MutualTlsAuthenticator in an mTLS environment, which...

Apache Cassandra 安全漏洞

Apache Cassandra is a distributed NoSQL database developed by the Apache Foundation in the United States. Version 4.0 of Apache Cassandra contains a security vulnerability. This vulnerability stems from the cqlsh command-line tool not properly clearing sensitive information, which may lead to the...

PT-2026-30915

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 4.0 through 4.0.19 Description Apache Cassandra's command-line tool, cqlsh, saves command history in the /.cassandra/cqlsh history file. This file does not redact sensitive information, meaning passwords used in cqlsh...

PT-2026-30903

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 5.0 through 5.0.6 Description A privilege escalation issue exists in Apache Cassandra 5.0 when using MutualTlsAuthenticator in an mTLS environment. A user with only CREATE permission can associate their own certificat...

GHSA-JFWG-RXF3-P7R9 Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

Vulnerability Details CWE: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic All 66+ CQL queries in internal/storage/db/cassandradb/ use fmt.Sprintf to interpolate user-controlled values directly into CQL query strings without parameterization. Unauthenticated endpoints...

Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

Vulnerability Details CWE: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic All 66+ CQL queries in internal/storage/db/cassandradb/ use fmt.Sprintf to interpolate user-controlled values directly into CQL query strings without parameterization. Unauthenticated endpoints...

CLEANSTART-2026-XR78310 Security fixes for CVE-2015-2104, CVE-2020-8908, CVE-2021-21295, CVE-2021-21409, CVE-2021-37136, CVE-2022-1471, CVE-2022-41881, CVE-2023-27043, CVE-2023-2976, CVE-2023-34462, CVE-2023-6378, CVE-2024-12254, CVE-2024-12718, CVE-2024-12798, CVE-2024-12801, CVE-2024-6232, CVE-2024-6923, CVE-2024-9287, CVE-2025-0938, CVE-2025-4138, CVE-2025-4330, CVE-2025-4516, CVE-2025-4517, CVE-2026-1225, ghsa-25qh-j22f-pwp8, ghsa-3mc7-4q67-w48m, ghsa-5mg8-w23w-74h3, ghsa-6v67-2wr5-gvf4, ghsa-72hv-8253-57qq, ghsa-7g45-4rm6-3mm3, ghsa-98wm-3w3q-mw94, ghsa-9w3m-gqgf-c4p9, ghsa-c4r9-r8fh-9vj2, ghsa-hhhw-99gj-p3c3, ghsa-mjmj-j48q-9wg2, ghsa-pr98-23f8-jwxv, ghsa-qqpg-mvqg-649v, ghsa-vmq6-5m68-f53m, ghsa-w37g-rhq8-7m4j applied in versions: 4.1.10-r1, 4.1.10-r2

Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CI66802 Security fixes for CVE-2015-2104, CVE-2020-8908, CVE-2021-21295, CVE-2021-21409, CVE-2021-37136, CVE-2022-1471, CVE-2022-41881, CVE-2023-27043, CVE-2023-2976, CVE-2023-34462, CVE-2023-6378, CVE-2024-12254, CVE-2024-12718, CVE-2024-12798, CVE-2024-12801, CVE-2024-27137, CVE-2024-6232, CVE-2024-6923, CVE-2024-9287, CVE-2025-0938, CVE-2025-23015, CVE-2025-4138, CVE-2025-4330, CVE-2025-4516, CVE-2025-4517, CVE-2026-1225, ghsa-25qh-j22f-pwp8, ghsa-3mc7-4q67-w48m, ghsa-5mg8-w23w-74h3, ghsa-6v67-2wr5-gvf4, ghsa-72hv-8253-57qq, ghsa-7g45-4rm6-3mm3, ghsa-98wm-3w3q-mw94, ghsa-9w3m-gqgf-c4p9, ghsa-c4r9-r8fh-9vj2, ghsa-hhhw-99gj-p3c3, ghsa-mjmj-j48q-9wg2, ghsa-pr98-23f8-jwxv, ghsa-qqpg-mvqg-649v, ghsa-vmq6-5m68-f53m, ghsa-w37g-rhq8-7m4j applied in versions: 4.0.17-r1, 4.0.19-r2, 4.0.19-r3, 4.1.9-r0

Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KM27583 Security fixes for CVE-2015-2104, CVE-2023-27043, CVE-2024-12254, CVE-2024-12718, CVE-2024-12798, CVE-2024-12801, CVE-2024-27137, CVE-2024-6232, CVE-2024-6923, CVE-2024-9287, CVE-2025-0938, CVE-2025-23015, CVE-2025-4138, CVE-2025-4330, CVE-2025-4516, CVE-2025-4517, CVE-2025-58057, CVE-2026-1225, ghsa-25qh-j22f-pwp8, ghsa-3p8m-j85q-pgmj, ghsa-5mg8-w23w-74h3, ghsa-6v67-2wr5-gvf4, ghsa-72hv-8253-57qq, ghsa-7g45-4rm6-3mm3, ghsa-pr98-23f8-jwxv, ghsa-qqpg-mvqg-649v applied in versions: 4.0.17-r1, 4.1.9-r0, 5.0.6-r1, 5.0.6-r2

Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details...