CVE-2026-27314

Summary

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY.

Users are recommended to upgrade to version 5.0.7+, which fixes this issue.

Affected Software

Weaknesses

• CWE-267: CWE-267 Privilege Defined With Unsafe Actions

ADP Enrichment

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2026/04/07/7

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://lists.apache.org/thread/zrng82ddy4rpsmfyk582v6hqxcqrbz7f

• ←Previous
• Next→