PUBLISHED
2026-04-07 17:16
MODIFIED
2026-04-07 17:16
EPSS (Prob. Exploit)
0.27%
Top 80.2%
> DESCRIPTION
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role,
including a superuser role, and authenticate as that role via ADD IDENTITY.
Users are recommended to upgrade to version 5.0.7+, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-267: Privilege Defined With Unsafe Actions - A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
> GITHUB SECURITY ADVISORY
GHSA-qxpc-96fq-wwmg
HIGH
Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator
AFFECTED PACKAGES:
MAVEN / org.apache.cassandra:cassandra-all
>= 5.0-alpha1, < 5.0.7
Fixed in: 5.0.7
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
ALIASES:
GHSA-qxpc-96fq-wwmg
> HISTORIQUE DES MODIFICATIONS
Première apparition
07/04/2026 17:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-267: Privilege Defined With Unsafe Actions - A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correc...
Total des modifications: 1
Dernière mise à jour: 6 months ago