- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 4 high, 4 medium
- Dependents
- 12
- Registry
- Maven Central
Advisories 12
- CVE-2026-32588Medium 6.5
Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing
Affected: from 4.0, through 4.0.19; from 4.1, through 4.1.10; from 5.0, through 5.0.6; from 4.0, fixed in 4.0.20; from 4.1, fixed in 4.1.11; from 5.0, fixed in 5.0.7.
- CVE-2026-27315Medium 5.5
Apache Cassandra: cqlsh history sensitive information leak
Affected: from 4.0, fixed in 4.0.20.
- CVE-2026-27314High 8.8
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
Affected: from 5.0, through 5.0.6; from 5.0-alpha1, fixed in 5.0.7.
- CVE-2025-26467High 8.8
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
Affected: from 4.0.16, fixed in 4.0.17.
- CVE-2024-27137Medium 5.3
Apache Cassandra: unrestricted deserialization of JMX authentication credentials
Affected: from 5.0-beta1, fixed in 5.0.3; from 4.1.0, fixed in 4.1.8; from 4.0.2, fixed in 4.0.15.
- CVE-2025-24860Medium 5.4
Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions
Affected: from 4.0-alpha1, fixed in 4.0.16; from 4.1-alpha1, fixed in 4.1.8; from 5.0-alpha1, fixed in 5.0.3.
- CVE-2025-23015High 8.8
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Affected: from 5.0-alpha1, fixed in 5.0.3; from 4.1-alpha1, fixed in 4.1.8; from 4.0-alpha1, fixed in 4.0.16; from 3.1, fixed in 3.11.18; fixed in 3.0.31.
- CVE-2023-30601High 7.8
Apache Cassandra: Privilege escalation when enabling FQL/Audit logs
Affected: from 4.1.0, fixed in 4.1.2; from 4.0.0, fixed in 4.0.10.
- CVE-2021-44521Unrated
Remote code execution for scripted UDFs
Affected: fixed in 3.0.26; from 3.11.0, fixed in 3.11.12; from 4.0.0, fixed in 4.0.2.
- CVE-2020-17516Unrated
Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack'…
Affected: from 2.1.0, fixed in 3.0.24; from 3.11.0, fixed in 3.11.10.
- CVE-2020-13946Unrated
In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without…
Affected: from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.18; from 3.0.0, fixed in 3.0.22; from 3.11.0, fixed in 3.11.8; from 4.0-beta1, fixed in 4.0-beta2.
- CVE-2018-8016Unrated
The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces…
Affected: from 3.8, fixed in 3.11.2.