CVE-2023-30601: Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-30 · updated 2026-06-17
Weakness: CWE-269

Description

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.

Affected products

Apache Software Foundation Apache Cassandra: from 4.0.0 before 4.0.10; from 4.1.0 before 4.1.2 — fixed in 4.0.10, 4.1.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Cassandra 4.0.10, 4.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-30601 or the next vulnerability affects your stack