Apache Software Foundation Apache Cassandra vulnerabilities

16 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Exploited Apache Software Foundation Apache Cassandra vulnerabilities

CVE-2026-32588 — Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing (CVSS 6.5)
CVE-2026-27315 — Apache Cassandra: cqlsh history sensitive information leak (CVSS 5.5)
CVE-2026-27314 — Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass (CVSS 8.8)
CVE-2025-26467 — Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only) (CVSS 8.8)
CVE-2025-24860 — Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions (CVSS 5.4)
CVE-2024-27137 — Apache Cassandra: unrestricted deserialization of JMX authentication credentials (CVSS 5.3)
CVE-2025-23015 — Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (CVSS 8.8)
CVE-2023-30601 — Apache Cassandra: Privilege escalation when enabling FQL/Audit logs (CVSS 7.8)
CVE-2021-44521 — Remote code execution for scripted UDFs (CVSS 9.1)
CVE-2020-17516 — (CVSS 7.5)
CVE-2020-13946 — (CVSS 5.9)
CVE-2019-2684 — (CVSS 5.9)
CVE-2018-8016 — (CVSS 9.8)
CVE-2016-4970 — (CVSS 7.5)
CVE-2016-3427 — Oracle Java SE and JRockit Unspecified Vulnerability (CVSS 9.8) — exploited
CVE-2015-0225 — (CVSS 7.5)