CVE-2025-26467: Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra 3.0.30, 3.11.17, 4.0.16, 4.1.7, 5.0.2, but this advisory is only for 4.0.16 because the fix to CVE-2025-23015 was incorrectly applied to 4.0.16, so that version is still affected.
Users in the 4.0 series are recommended to upgrade to version 4.0.17 which fixes the issue. Users from 3.0, 3.11, 4.1 and 5.0 series should follow recommendation from CVE-2025-23015.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26467?
CVE-2025-26467 is considered critical due to its potential for privilege escalation to superuser in Apache Cassandra.
How do I fix CVE-2025-26467?
To mitigate CVE-2025-26467, upgrade to Apache Cassandra version 4.0.17 or later.
Who is affected by CVE-2025-26467?
CVE-2025-26467 affects all users of Apache Cassandra version 4.0.16 and earlier with MODIFY permission on all keyspaces.
What actions can lead to exploitation of CVE-2025-26467?
Exploitation of CVE-2025-26467 can occur through unsafe actions targeting system resources by users with relevant permissions.
Is CVE-2025-26467 a known issue in other Apache Cassandra versions?
CVE-2025-26467 primarily affects Apache Cassandra versions prior to 4.0.17, including those within the 3.x and early 4.x series.