A Privilege Defined With Unsafe Actions vulnerability exists in Apache Cassandra, allowing a user with MODIFY permission ON ALL KEYSPACES to escalate privileges to superuser within a targeted Cassandra cluster. This issue affects specific versions of Apache Cassandra, particularly 4.0.16, which has an incorrectly applied fix for CVE-2025-23015. Users are advised to review data access rules and upgrade to the recommended versions to mitigate potential breaches.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-26467 |
Exploitation
To exploit this vulnerability, an attacker with MODIFY permission on all keyspaces can perform unsafe actions on system resources, allowing them to escalate their privileges to superuser within the Cassandra cluster. This can lead to unauthorized access and manipulation of sensitive data.
Affected Products
- Apache Cassandra 3.0.30: An older version that is vulnerable to privilege escalation.
- Apache Cassandra 3.11.17: Another affected version that requires attention for security compliance.
- Apache Cassandra 4.0.16: The specific version with an incorrectly applied fix, still vulnerable.
- Apache Cassandra 4.1.7: Users should follow recommendations from related advisories.
- Apache Cassandra 5.0.2: Also affected and requires users to upgrade.
Mitigation
Users of Apache Cassandra, especially those on version 4.0.16, are strongly recommended to upgrade to version 4.0.17, which addresses this vulnerability. Additionally, operators should review and tighten data access rules to prevent unauthorized privilege escalation.