Vulnerability · Published Feb 13, 2025 · Assigned by netapp
CVE-2025-26511Cassandra-Lucene-Index allows bypass of Cassandra RBAC
High 8.8
In plain English
A high-severity incorrect authorization in Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin from NetApp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC and escalate their privileges.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.instaclustr:cassandra-lucene-index-plugin | 4.0.17-1.0.0 | GHSA-mrqp-q7vx-v2cx |
| Maven | com.instaclustr:cassandra-lucene-index-plugin | 4.1.8-1.0.1 | GHSA-mrqp-q7vx-v2cx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NetApp | Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin | 4.0-rc1-1.0.0 – through 4.0.16-1.0.04.1.2-1.0.0 – through 4.1.8-1.0.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H