What’s Vulnerable › Vulnerabilities
CVE-2026-47846
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-18 · updated 2026-10-26
- Weakness: CWE-798
Description
Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path. Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.
Affected products
- bitnami/cassandra: from 4.0.0 before 4.0.20-photon-5-r7; from 4.1.0 before 4.1.11-photon-5-r7; from 5.0.0 before 5.0.8-photon-5-r4 — fixed in 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4
How to fix
Upgrade to a fixed version: bitnami/cassandra 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-47846 or the next vulnerability affects your stack