CVE-2025-26511

Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow...

CVE-2025-26511

CVE-2025-26511 affects the Instaclustr fork of Stratio’s Cassandra-Lucene-Index plugin when installed into Apache Cassandra 4.x. The vulnerability allows authenticated Cassandra users to bypass RBAC and escalate privileges due to a flaw in the plugin’s access control. Affected plugin versions are...

CVE-2025-26511 Cassandra-Lucene-Index allows bypass of Cassandra RBAC

Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow...

CVE-2025-26511 Cassandra-Lucene-Index allows bypass of Cassandra RBAC

Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow...

CVE-2025-26511 Cassandra-Lucene-Index allows bypass of Cassandra RBAC

Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow...

CVE-2025-26511: Incorrect Authorization

Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow...

Cassandra-Lucene-Index security vulnerability

cassandra-lucene-index is a Lucene-based secondary index for Cassandra open-sourced by NetApp Instaclustr. A security vulnerability exists in cassandra-lucene-index. An authenticated attacker could remotely bypass RBAC and elevate its privileges by exploiting this vulnerability...

PT-2025-7174

Name of the Vulnerable Software and Affected Versions: Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.1.0-1.0.0 through 4.1.8-1.0.0 Description: The vulnerability allows...

com.facebook.presto:presto-cassandra (>=0.146, <=0.166), com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.6.2) +5 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.6)

org.apache.cassandra:cassandra-all MAVEN version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.facebook.presto:presto-cassandra =0.146, =0.1.0.final, =0.1.0.final, =0.4.0.final,...

com.stratio.cassandra:cassandra-lucene-index-plugin (>=2.2.11.0, <=2.2.12.0) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.11)

org.apache.cassandra:cassandra-all MAVEN version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin =2.2.11.0, =2.2.12.0 Source cves:...

com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.12.0), org.zalando:cassandra-maven-plugin (>=2.1.7-z2, <=2.1.7-z4) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.12)

org.apache.cassandra:cassandra-all MAVEN version 2.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin 2.1.12.0 -...

com.stratio.cassandra:cassandra-lucene-index-plugin (2.2.8.0) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.8)

org.apache.cassandra:cassandra-all MAVEN version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin 2.2.8.0 Source cves: CVE-2025-23015...

com.stratio.cassandra:cassandra-lucene-index-plugin (2.2.10.0) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.10)

org.apache.cassandra:cassandra-all MAVEN version 2.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin 2.2.10.0 Source cves: CVE-2025-23015...

com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.15.0) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.15)

org.apache.cassandra:cassandra-all MAVEN version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin 2.1.15.0 Source cves: CVE-2025-23015...

com.github.jparkie:spark2cassandra_2.10 (2.1.0), com.github.jparkie:spark2cassandra_2.11 (2.1.0) +1 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.13)

org.apache.cassandra:cassandra-all MAVEN version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.github.jparkie:spark2cassandra2.10 2.1.0 - com.github.jparkie:spark2cassandra2.11 2.1....

com.att.cadi:cadi-cass (>=1.3.0, <=1.3.2-oss), com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.14.0) +2 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.14)

org.apache.cassandra:cassandra-all MAVEN version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.att.cadi:cadi-cass =1.3.0, =1.0.0, =1.0.0, =1.2.2 Source cves: CVE-2025-23015 Source...

com.stratio.cassandra:cassandra-lucene-index-plugin (>=2.2.3.0, <=2.2.3.2), info.archinnov:achilles-embedded (>=3.2.4-zeppelin, <=4.0.1) +3 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.3)

org.apache.cassandra:cassandra-all MAVEN version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin =2.2.3.0, =3.2.4-zeppelin,...

com.stratio.cassandra:cassandra-lucene-index-plugin (>=2.1.8.1, <=2.1.8.6), org.apache.atlas:atlas-index-repair-tool (>=2.2.0, <=2.4.0) +2 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.8)

org.apache.cassandra:cassandra-all MAVEN version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin =2.1.8.1, =2.2.0, =2.2.0, =2.4.0 -...

com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.11.1) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.11)

org.apache.cassandra:cassandra-all MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin 2.1.11.1 Source cves: CVE-2025-23015...

com.stratio.cassandra:cassandra-lucene-index-plugin (>=2.2.7.0, <=2.2.7.1), io.cassandrareaper:cassandra-reaper (>=1.0.2, <=1.1.0) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.7)

org.apache.cassandra:cassandra-all MAVEN version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.stratio.cassandra:cassandra-lucene-index-plugin =2.2.7.0, =1.0.2, =1.1.0 Source cves:...