CVE-2021-44521

CVE-2021-44521 affects Apache Cassandra when enable_user_defined_functions: true, enable_scripted_user_defined_functions: true, and enable_user_defined_functions_threads: false. The documented unsafe configuration can allow an attacker with cluster-level permissions to create user-defined functio...

CVE-2016-3427

CVE-2016-3427 is an unspecified vulnerability in Oracle Java SE (affecting 6u113, 7u99, 8u77) and JRockit, tied to the Java Management Extensions (JMX) component. Exploitation can affect confidentiality, integrity, and availability via JMX-related vectors; the issue is described as an unspecified...

CVE-2019-2684

CVE-2019-2684 concerns Oracle Java SE and Java SE Embedded, specifically the RMI component. The connected Chainguard entry shows affected packages for OpenJDK builds (openjdk-21/openj9, openjdk-8/openj9, openjdk-11/openj9, openjdk-17/openj9). The initial description identifies affected Oracle Jav...

CVE-2023-30601

CVE-2023-30601 : Privilege escalation in Apache Cassandra when enabling FQL/Audit logs. A local attacker with nodetool/JMX access can execute arbitrary commands as the Cassandra process user due to a flaw in the FQL/Audit logs implementation. Affected versions: Cassandra 4.0.0–4.0.9 and 4.1.0–4.1...

CVE-2020-13946

CVE-2020-13946 relates to an Apache Cassandra RMI registry manipulation vulnerability enabling a local attacker to perform a man-in-the-middle attack to capture JMX credentials and gain unauthorized access. The connected CIRCL entry confirms affected ranges: Cassandra 4.0.2 through 5.0.2 (Java 11...

CVE-2025-23015

Apache Cassandra is vulnerable to a Privilege Defined With Unsafe Actions vulnerability, where a user with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser by performing unsafe actions on a system resource. This issue impacts versions through 3.0.30, 3.11.17, 4.0.15, 4.1.7,...

CVE-2025-24860

An Incorrect Authorization vulnerability in Apache Cassandra allows users to bypass restrictions and access datacenters or IP/CIDR groups they are not permitted to access. This issue arises when using the CassandraNetworkAuthorizer or CassandraCIDRAuthorizer components. Specifically, users with r...

CVE-2024-27137

In Apache Cassandra (versions 4.0.2 through 5.0.2 running Java 11 ), a local attacker without access to the process or configuration files can manipulate the RMI registry . This enables a man-in-the-middle attack to capture usernames and passwords used for the JMX interface , potentially leading ...

CVE-2020-17516

CVE-2020-17516 affects Apache Cassandra versions 2.1.0–2.1.22, 2.2.0–2.2.19, 3.0.0–3.0.23, and 3.11.0–3.11.9 when using internode_encryption (dc/rack). A misconfigured node or a malicious user could use an unencrypted internode connection to bypass mutual TLS, potentially exposing or altering int...

CVE-2016-4970

Netty CVE-2016-4970 affects OpenSslEngine in Netty 4.0.x prior to 4.0.37.Final and 4.1.x prior to 4.1.1.Final. The issue arises from improper handling of renegotiation, enabling remote attackers to cause a denial of service via an infinite loop. Remediation is to upgrade to Netty 4.0.37.Final or ...

CVE-2018-8016

CVE-2018-8016 affects Apache Cassandra 3.8–3.11.1, where the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, allowing a remote attacker to execute arbitrary Java code via an RMI request. This is a regression of CVE-2015-0225, introduced in CASSANDRA-121...

CVE-2015-0225

CVE-2015-0225 affects Apache Cassandra 1.2.0–1.2.19, 2.0.0–2.0.13, and 2.1.0–2.1.3, where an unauthenticated JMX/RMI interface bound to all network interfaces allows remote attackers to execute arbitrary Java code via RMI. The connected advisories indicate this is a regression path tracked in lat...

CVE-2026-32588

Apache Cassandra versions 4.0, 4.1, and 5.0 are vulnerable to an authenticated Denial of Service (DoS) over CQL. The root cause is uncontrolled resource consumption (CWE-400) where an authenticated user can intentionally raise query latencies by performing repeated password changes. This impact o...

CVE-2025-26467

A Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra allows a user with MODIFY permission on all keyspaces to escalate privileges to superuser status. The attacker achieves this by performing unsafe actions targeting a system resource. While multiple versions are impacted (3....

CVE-2026-27314

Apache Cassandra version 5.0 is vulnerable to privilege escalation in environments utilizing mTLS with MutualTlsAuthenticator . An attacker possessing only CREATE permissions can exploit this by using the ADD IDENTITY command to associate their own certificate identity with an arbitrary role, suc...

CVE-2026-27315

Apache Cassandra version 4.0 is vulnerable to a Sensitive Information Leak in its cqlsh command-line tool. The tool fails to redact sensitive information, such as passwords , when saving command history to the ~/.cassandra/cqlsh_history local file. This allows an attacker with local file access t...