Apache cassandra

This hub aggregates every CVE we track for Apache cassandra, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 10 most recently published vulnerabilities affecting Apache cassandra.

• CVE-2026-32588Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing6.5Apr 7, 2026
• CVE-2026-27315Apache Cassandra: cqlsh history sensitive information leak5.5Apr 7, 2026
• CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass8.8Apr 7, 2026
• CVE-2025-26467Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)8.8Aug 25, 2025
• CVE-2024-27137Apache Cassandra: unrestricted deserialization of JMX authentication credentials5.3Feb 4, 2025
• CVE-2025-24860Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions5.4Feb 4, 2025
• CVE-2025-23015Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions8.8Feb 4, 2025
• CVE-2023-30601Apache Cassandra: Privilege escalation when enabling FQL/Audit logs7.8May 30, 2023
• CVE-2021-44521Remote code execution for scripted UDFs9.1Feb 11, 2022
• CVE-2018-8016The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code v...9.8Jun 28, 2018