CVE-2025-26511: Cassandra-Lucene-Index allows bypass of Cassandra RBAC

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-13 · updated 2026-06-17
Weakness: CWE-863

Description

Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC and escalate their privileges.

Affected products

NetApp Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin: from 4.0-rc1-1.0.0 through 4.0.16-1.0.0; from 4.1.2-1.0.0 through 4.1.8-1.0.0

References

https://github.com/instaclustr/cassandra-lucene-index/security/advisories/GHSA-mrqp-q7vx-v2cx
https://github.com/instaclustr/cassandra-lucene-index/commit/44ab4b639c9354a6335f40b1cf6178c745c6e101

Get alerted when CVE-2025-26511 or the next vulnerability affects your stack