Summary
Ein Angreifer kann mehrere Schwachstellen in Apache Cassandra ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.
Product
Cassandra ist ein einfaches, verteiltes Datenbankverwaltungssystem für sehr große strukturierte Datenbanken.
Vulnerabilities 3
-
High 8.8
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that…
-
Medium 6.5
Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.
-
Medium 5.5
Apache Cassandra: cqlsh history sensitive information leak
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via ~/.cassandra/cqlsh_history local file access. Users are recommended to upgrade to version 4.0.20, w…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-qxpc-96fq-wwmg vom 2026-04-07
https://github.com/advisories/GHSA-qxpc-96fq-wwmg
-
Mailing List OSS Security - CVE-2026-27314 vom 2026-04-07
https://seclists.org/oss-sec/2026/q2/32
-
GitHub Security Advisory GHSA-fh34-c629-p8xj vom 2026-04-07
https://github.com/advisories/GHSA-fh34-c629-p8xj
-
Mailing List OSS Security - CVE-2026-27315 vom 2026-04-07
https://seclists.org/oss-sec/2026/q2/33
-
GitHub Security Advisory GHSA-qffm-gf3j-6mvg vom 2026-04-07
https://github.com/advisories/GHSA-qffm-gf3j-6mvg
-
Mailing List OSS Security - CVE-2026-32588 vom 2026-04-07
https://seclists.org/oss-sec/2026/q2/34