Apache Cassandra (Apache Software Foundation) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-04-07. Vendor: Apache Software Foundation.
CVEs of Apache Cassandra
- CVE-2026-32588 - CVSS 6.5 (medium), 2026-04-07: Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are…
- CVE-2026-27315 - CVSS 5.5 (medium), 2026-04-07: Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via…
- CVE-2026-27314 - CVSS 8.8 (high), 2026-04-07: Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their…
- CVE-2025-26467 - CVSS 8.8 (high), 2025-08-25: Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser…
- CVE-2025-24860 - CVSS 5.4 (medium), 2025-02-04: Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using…
- CVE-2024-27137 - CVSS 5.3 (medium), 2025-02-04: In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry…
- CVE-2025-23015 - CVSS 8.8 (high), 2025-02-04: Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser…
- CVE-2023-30601 - CVSS 7.8 (high), 2023-05-30: Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue…
- CVE-2021-44521 - CVSS 9.1 (critical), 2022-02-11: When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true…
- CVE-2018-8016 - CVSS 9.8 (critical), 2018-06-28: The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote…
