CVE-2026-27314 json
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
published 7mo ago modified 14d ago also EUVD-2026-19761 , GHSA-qxpc-96fq-wwmg
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY.
Users are recommended to upgrade to version 5.0.7+, which fixes this issue.
Patch / fix
- maven org.apache.cassandra:cassandra-all 5.0.7
- org.apache.cassandra cassandra-all 5.0.7
Is CVE-2026-27314 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.cassandra:cassandra-all | >=5.0-alpha1, <5.0.7 |
5.0.7 |
Affected products
- Apache Software Foundation Apache Cassandra
Classification
- Weakness
-
- CWE-267 Privilege Defined With Unsafe Actions
References
-
github.com
/apache/cassandra/commit/b584a435970e5125e1def5148d943c39569dc7af
web
-
lists.apache.org
/thread/zrng82ddy4rpsmfyk582v6hqxcqrbz7f
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2026/04/07/7
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-27314
advisory
-
github.com
/apache/cassandra
package
-
github.com
/apache/cassandra/releases/tag/cassandra-5.0.7
web
Sources
- CVE List CVE-2026-27314
- GitHub Advisory GHSA-qxpc-96fq-wwmg
- NVD CVE-2026-27314
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.