Not rated
CVE-2025-23015 Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Description
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Cassandra 5.0 | 5.0.0 → 5.0.2 | No fix stated |
| Apache Cassandra 4.1 | 4.1.0 → 4.1.7 | No fix stated |
| Apache Cassandra 4.0 | 4.0.0 → 4.0.15 | No fix stated |
| Apache Cassandra 3.1 | 3.1.0 → 3.11.17 | No fix stated |
| Apache Cassandra 3.0 | 3.0.0 → 3.0.30 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Cassandra
The 10 CVEs of Apache Cassandra →
CVE-2026-32588
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via…
Not rated
CVE-2026-27315
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from…
Not rated
CVE-2026-27314
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only…
Not rated
CVE-2025-26467
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Not rated