# org.apache.cassandra:cassandra-all (Maven) vulnerabilities

12 known vulnerabilities (4 high, 4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Dependents: 12
- Registry: https://central.sonatype.com/artifact/org.apache.cassandra/cassandra-all

## Advisories (12)

### [CVE-2026-32588](https://cve.now/CVE-2026-32588): Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing

- Severity: Medium 6.5
- Published: Apr 7, 2026
- Affected: from 4.0, through 4.0.19; from 4.1, through 4.1.10; from 5.0, through 5.0.6; from 4.0, fixed in 4.0.20; from 4.1, fixed in 4.1.11; from 5.0, fixed in 5.0.7.

### [CVE-2026-27315](https://cve.now/CVE-2026-27315): Apache Cassandra: cqlsh history sensitive information leak

- Severity: Medium 5.5
- Published: Apr 7, 2026
- Affected: from 4.0, fixed in 4.0.20.

### [CVE-2026-27314](https://cve.now/CVE-2026-27314): Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

- Severity: High 8.8
- Published: Apr 7, 2026
- Affected: from 5.0, through 5.0.6; from 5.0-alpha1, fixed in 5.0.7.

### [CVE-2025-26467](https://cve.now/CVE-2025-26467): Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)

- Severity: High 8.8
- Published: Aug 25, 2025
- Affected: from 4.0.16, fixed in 4.0.17.

### [CVE-2024-27137](https://cve.now/CVE-2024-27137): Apache Cassandra: unrestricted deserialization of JMX authentication credentials

- Severity: Medium 5.3
- Published: Feb 4, 2025
- Affected: from 5.0-beta1, fixed in 5.0.3; from 4.1.0, fixed in 4.1.8; from 4.0.2, fixed in 4.0.15.

### [CVE-2025-24860](https://cve.now/CVE-2025-24860): Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions

- Severity: Medium 5.4
- Published: Feb 4, 2025
- Affected: from 4.0-alpha1, fixed in 4.0.16; from 4.1-alpha1, fixed in 4.1.8; from 5.0-alpha1, fixed in 5.0.3.

### [CVE-2025-23015](https://cve.now/CVE-2025-23015): Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions

- Severity: High 8.8
- Published: Feb 4, 2025
- Affected: from 5.0-alpha1, fixed in 5.0.3; from 4.1-alpha1, fixed in 4.1.8; from 4.0-alpha1, fixed in 4.0.16; from 3.1, fixed in 3.11.18; fixed in 3.0.31.

### [CVE-2023-30601](https://cve.now/CVE-2023-30601): Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

- Severity: High 7.8
- Published: May 30, 2023
- Affected: from 4.1.0, fixed in 4.1.2; from 4.0.0, fixed in 4.0.10.

### [CVE-2021-44521](https://cve.now/CVE-2021-44521): Remote code execution for scripted UDFs

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 3.0.26; from 3.11.0, fixed in 3.11.12; from 4.0.0, fixed in 4.0.2.

### [CVE-2020-17516](https://cve.now/CVE-2020-17516): Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack'…

- Severity: Unrated
- Published: Feb 3, 2021
- Affected: from 2.1.0, fixed in 3.0.24; from 3.11.0, fixed in 3.11.10.

### [CVE-2020-13946](https://cve.now/CVE-2020-13946): In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without…

- Severity: Unrated
- Published: Sep 1, 2020
- Affected: from 2.1.0, fixed in 2.1.12; from 2.2.0, fixed in 2.2.18; from 3.0.0, fixed in 3.0.22; from 3.11.0, fixed in 3.11.8; from 4.0-beta1, fixed in 4.0-beta2.

### [CVE-2018-8016](https://cve.now/CVE-2018-8016): The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces…

- Severity: Unrated
- Published: Jun 28, 2018
- Affected: from 3.8, fixed in 3.11.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.cassandra:cassandra-all
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.