CVE-2026-27314: Apache Cassandra Privilege Escalation in mTLS Environment
Summary
CVE-2026-27314: Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a s... Affects org.apache.cassandra:cassandra-all versions >= 5.0-alpha1, < 5.0.7. Fixed in 5.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Cassandra is a highly scalable, distributed NoSQL database designed to handle large amounts of data across many commodity servers. It offers high availability with no single point of failure. The database supports various authentication methods, including Mutual TLS (mTLS), which enhances security by requiring both the client and server to authenticate each other using certificates. However, a recent vulnerability has been identified in the MutualTlsAuthenticator that allows unauthorized privilege escalation.
Vulnerability Detail
The vulnerability in Apache Cassandra 5.0 arises from the MutualTlsAuthenticator in an mTLS environment. It allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role. This means that an attacker could authenticate as a superuser and gain elevated privileges, potentially leading to unauthorized access to sensitive data or the ability to modify critical configurations. The issue is particularly concerning as it undermines the security model of mTLS, which is designed to prevent such privilege escalations.
How To Fix
Minimum fixed version
5.0.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Cassandra instance by implementing stricter network controls and limiting the permissions granted to users until the upgrade can be performed. Additionally, consider disabling mTLS if it is not essential for your application until the patch is applied.
Conclusion
The vulnerability identified as CVE-2026-27314 in Apache Cassandra poses a significant risk due to the potential for privilege escalation in an mTLS environment. Users are strongly encouraged to upgrade to version 5.0.7 or later to mitigate this risk. Implementing temporary workarounds can help secure the environment until the upgrade is completed.
See every vulnerability recorded for org.apache.cassandra:cassandra-all →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Apache Cassandra versions prior to 5.0.7 are affected by this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If an immediate upgrade is not possible, implement stricter network controls and limit user permissions as a temporary workaround.
Mutual TLS (mTLS) is an authentication method that requires both the client and server to authenticate each other using certificates, enhancing security in communications.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cassandra:cassandra-all.
