Vulnerability · Published Apr 7, 2026 · Assigned by apache
CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
High 8.8
In plain English
A high-severity security flaw in Apache Cassandra from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are recommended to upgrade to version 5.0.7+, which fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.cassandra:cassandra-all | 5.0.7 | GHSA-qxpc-96fq-wwmg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Cassandra | 5.0 – through 5.0.6 |
Weakness: CWE-267 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H