CVE-2026-27314

Опубликовано: 07 апр. 2026

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY.

Users are recommended to upgrade to version 5.0.7+, which fixes this issue.

Ссылки

https://lists.apache.org/thread/zrng82ddy4rpsmfyk582v6hqxcqrbz7f
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/07/7
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.7 (исключая)

EPSS

Процентиль: 18%

0.00263

Низкий

8.8 High

CVSS3

Дефекты

CWE-267

Связанные уязвимости

CVE-2026-27314

CVSS3: 8.8

debian

4 месяца назад

Privilege escalationin Apache Cassandra 5.0 on an mTLS environment usi ...

GHSA-qxpc-96fq-wwmg

CVSS3: 8.8

github

4 месяца назад

Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator

EPSS

Процентиль: 18%

0.00263

Низкий

8.8 High

CVSS3

Дефекты

CWE-267