CVE-2026-27315: Apache Cassandra Sensitive Information Leak in cqlsh Command History
Summary
CVE-2026-27315: Apache Cassandra has sensitive Information Leak in cqlsh. Affects org.apache.cassandra:cassandra-all versions >= 4.0, < 4.0.20. Fixed in 4.0.20. How to fix ↓
Also tracked for
- cassandra · Bitnami
The same CVE-2026-27315 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Cassandra is a highly scalable, distributed NoSQL database designed to handle large amounts of data across many commodity servers. It offers high availability with no single point of failure. The command-line interface, cqlsh, allows users to interact with the database using CQL (Cassandra Query Language). However, a recent vulnerability has been identified that compromises the security of sensitive information stored in command history.
Vulnerability Detail
The vulnerability arises from the cqlsh command history feature, which saves previously executed commands in a local file located at ~/.cassandra/cqlsh_history. This file does not redact sensitive information, such as passwords, leading to a potential information leak. If a user executes commands that include sensitive data, this information is stored in cleartext, making it accessible to anyone with file access. The ramifications include unauthorized access to sensitive credentials, which could lead to further exploitation of the database.
How To Fix
Minimum fixed version
4.0.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually delete the ~/.cassandra/cqlsh_history file after executing commands that contain sensitive information. However, this is not a permanent solution and upgrading to the patched version is strongly recommended.
Conclusion
The sensitive information leak in Apache Cassandra's cqlsh poses a significant risk to users who execute commands containing sensitive data. Upgrading to version 4.0.20 is essential to mitigate this vulnerability. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for org.apache.cassandra:cassandra-all →
FAQ
CVE-2026-27315 is a vulnerability in Apache Cassandra's cqlsh that allows sensitive information, such as passwords, to be stored in cleartext in the command history file.
If your application uses cqlsh and executes commands with sensitive information, this data could be exposed to unauthorized users who have access to the command history file.
If an immediate upgrade is not possible, manually delete the ~/.cassandra/cqlsh_history file after executing sensitive commands to mitigate the risk temporarily.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check if your application is affected using the Vulert playground.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cassandra:cassandra-all.
