Not rated
CVE-2021-44521 When running Apache Cassandra with the following configuration: enable_user_defined_functions: true…
Description
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Cassandra 4.0 | earliest → latest | 4.0.2 |
| Apache Cassandra 3.11 | earliest → < 3.11.12 | 3.11.12 |
| Apache Cassandra 3.1 | 3.1 → latest | No fix stated |
| Apache Cassandra 3.0 | earliest → latest | 3.0.26 |
References
- lists.apache.org lists.apache.org
- [oss-security] 20220211 CVE-2021-44521: Apache Cassandra: Remote code execution for scripted UDFs www.openwall.com
- jfrog.com jfrog.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Apache Cassandra
The 10 CVEs of Apache Cassandra →
CVE-2026-32588
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via…
Not rated
CVE-2026-27315
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from…
Not rated
CVE-2026-27314
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only…
Not rated
CVE-2025-26467
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Not rated