GitHub Advisoryadvisory · Maven

GHSA-qxpc-96fq-wwmg Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator

HIGH Published 2026-04-07 Modified 2026-04-08 Official page ↗
Aliases
CVE-2026-27314
Ecosystem
Maven
Packages
org.apache.cassandra:cassandra-all
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-267
Reviewed
2026-04-08

Affected packages

• Maven org.apache.cassandra:cassandra-all: >= 5.0-alpha1, < 5.0.7 → fixed in 5.0.7

Description

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are recommended to upgrade to version 5.0.7+, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-27314 Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission… vulnerability

Weakness · CWE (1)

  • CWE-267 Privilege Defined With Unsafe Actions weakness

References