CVE-2026-27314
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
Résumé
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role,
including a superuser role, and authenticate as that role via ADD IDENTITY.
Users are recommended to upgrade to version 5.0.7+, which fixes this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com
- web repo.maven.apache.org