CVE-2026-27314

published 2026-04-07

CVE-2026-27314: Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their…

high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role,
including a superuser role, and authenticate as that role via ADD IDENTITY.

Users are recommended to upgrade to version 5.0.7+, which fixes this issue.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apache_software_foundation	apache_cassandra	5.0 – 5.0.6	—

CWE-267