~ / search / GHSA-qxpc-96fq-wwmg

GHSA-qxpc-96fq-wwmg

Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator

Source: GitHub Advisory Database (reviewed) High CVE-2026-27314

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.cassandra:cassandra-all >= 5.0-alpha1, < 5.0.7 5.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are recommended to upgrade to version 5.0.7+, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.