Skip to content
fr Sign in
7.8 High

CVE-2023-30601 Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user…

Description

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.

Affected products and versions

Product Affected versions Fixed in
Apache Cassandra 4.1 4.1.0 → 4.1.1 No fix stated
Apache Cassandra 4.0 4.0.0 → 4.0.9 No fix stated
cassandra 4.1 4.1.0 → 4.1.1 No fix stated
cassandra 4.0 4.0.0 → 4.0.9 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Cassandra

The 10 CVEs of Apache Cassandra →
CVE-2026-32588 Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via… Not rated CVE-2026-27315 Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from… Not rated CVE-2026-27314 Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only… Not rated CVE-2025-26467 Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra Not rated
Track this CVE