CVE-2026-27314 json
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
published 2026-04-07 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-19761 , GHSA-qxpc-96fq-wwmg
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY.
Users are recommended to upgrade to version 5.0.7+, which fixes this issue.
Patch / fix
- maven org.apache.cassandra:cassandra-all 5.0.7
- org.apache.cassandra cassandra-all 5.0.7
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.cassandra:cassandra-all | >=5.0-alpha1, <5.0.7 |
5.0.7 |
Affected products
- Apache Software Foundation Apache Cassandra
Classification
- Weakness
-
- CWE-267 Privilege Defined With Unsafe Actions
References
-
github.com
/apache/cassandra/commit/b584a435970e5125e1def5148d943c39569dc7af
web
-
lists.apache.org
/thread/zrng82ddy4rpsmfyk582v6hqxcqrbz7f
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2026/04/07/7
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-27314
advisory
-
github.com
/apache/cassandra
package
-
github.com
/apache/cassandra/releases/tag/cassandra-5.0.7
web
Sources
- CVE List CVE-2026-27314
- GitHub Advisory GHSA-qxpc-96fq-wwmg
- NVD CVE-2026-27314
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.