Aller au contenu
en Se connecter
Non notée

CVE-2026-27315 Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from…

Description

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via  ~/.cassandra/cqlsh_history local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description: Cassandra's command-line tool, cqlsh, provides a command history feature that allows users to recall previously executed commands using the up/down arrow keys. These history records are saved in the ~/.cassandra/cqlsh_history file in the user's home directory. However, cqlsh does not redact sensitive information when saving command history. This means that if a user executes operations involving passwords (such as logging in or creating users) within cqlsh, these passwords are permanently stored in cleartext in the history file on the disk.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Cassandra 4.0 4.0 → 4.0.19 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Cassandra

Les 10 CVE de Apache Cassandra →
CVE-2026-32588 Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via… Non notée CVE-2026-27314 Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only… Non notée CVE-2025-26467 Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra Non notée CVE-2024-27137 In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration… Non notée
Suivre cette CVE