Cassandra CVE-2026-32588

This vulnerability presents low real-world risk despite a moderate CVSS score. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H vector correctly identifies network-reachable impact on availability (A:H) but requires authenticated access (PR:L), limiting the attack surface. The EPSS score of 0.02% (5th percentile) strongly signals that automated exploitation is unlikely in practice, likely because: (1) the attack requires valid credentials, ruling out anonymous attackers; (2) the impact is service degradation rather than data breach or code execution, reducing attacker motivation; (3) most deployments implement monitoring and resource quotas that would detect and mitigate repeated password changes. SSVC analysis: exploitation is possible (authenticated users have capability), but automatable exploitation is minimal (requires credential compromise and detection evasion). The technical impact is high (availability loss), but blast radius is limited to authenticated sessions. Conclusion: organizations with strict access controls and proper authentication monitoring can deprioritize this; however, environments allowing weak or widely-shared credentials should patch.

An attacker with valid Cassandra credentials (obtained through credential compromise, insider access, or weak authentication) opens a CQL session and repeatedly issues ALTER USER password-change commands in rapid succession. Each password change triggers authentication subsystem processing; the lack of rate limiting allows the attacker to saturate the server's processing queue. Legitimate user queries experience elevated latencies or timeout, degrading service availability. Detection would likely trigger only if query monitoring and authentication logging are enabled and actively reviewed.