Apache Software Foundation Apache Cassandra
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-32588 | 4.0 – 4.0.19 ; 4.1 – 4.1.10 ; 5.0 – 5.0.6 | Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-27315 | 4.0 – 4.0.19 | Apache Cassandra: cqlsh history sensitive information leak | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-27314 | 5.0 – 5.0.6 | Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass | HIGH 8.8 | 0.3 % | ||
| CVE-2025-26467 | 4.0.16 | Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only) | HIGH 8.8 | 0.5 % | ||
| CVE-2024-27137 | 4.0.2 – < 4.0.15 ; 4.1.0 – < 4.1.8 ; 5.0-beta1 – < 5.0.3 | Apache Cassandra: unrestricted deserialization of JMX authentication credentials | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-24860 | 4.0.0 – 4.0.15 ; 4.1.0 – 4.1.7 ; 5.0.0 – 5.0.2 | Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions | MEDIUM 5.4 | 1.1 % | ||
| CVE-2025-23015 | 3.0.0 – 3.0.30 ; 3.1.0 – 3.11.17 ; 4.0.0 – 4.0.15 ; … | Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions | HIGH 8.8 | 1.0 % | ||
| CVE-2023-30601 | 4.0.0 – 4.0.9 ; 4.1.0 – 4.1.1 | Apache Cassandra: Privilege escalation when enabling FQL/Audit logs | HIGH 7.8 | 0.3 % | ||
| CVE-2021-44521 | 3.0.0 – < unspecified ; unspecified – < 3.0.26 ; 3.1 – < unspecified ; … | Remote code execution for scripted UDFs | CRITICAL 9.1 | 59 % | ||
| CVE-2018-8016 | Apache Cassandra 3.8 to 3.11.1 | The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which | CRITICAL 9.8 | 2.3 % |