PT-2026-30903

CVE-2026-27314

Published

2026-04-07

Updated

2026-06-17

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 5.0 through 5.0.6

Description A privilege escalation issue exists in Apache Cassandra 5.0 when using MutualTlsAuthenticator in an mTLS environment. A user with only CREATE permission can associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via the ADD IDENTITY function.

Recommendations Upgrade to version 5.0.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sho Odagiri

Vendors

Affected products

Weakness enumeration

CWE-267: Privilege Defined With Unsafe Actions

Related identifiers