Apache Cassandra EUVD-2026-19761

Apache Cassandra 5.0 through 5.0.6 configured with mTLS and MutualTlsAuthenticator enabled. Attacker requires authenticated user with CREATE permission. No victim interaction needed. Allows privilege escalation to superuser via ADD IDENTITY command.

This vulnerability presents a critical risk specifically to Apache Cassandra 5.0 deployments using mTLS authentication, though real-world exposure is limited by the requirement for authenticated access (CVSS PR:L) and specific configuration. CVSS 8.8 with network attack vector (AV:N) and low complexity (AC:L) indicates straightforward exploitation once an attacker gains CREATE permission. SSVC framework classification shows no current exploitation activity, confirms the attack is not automatable (requires authenticated session and specific permissions), but assigns total technical impact since successful exploitation yields complete database control. The absence of KEV listing and public exploits reduces immediate urgency, but the total technical impact and ease of exploitation (AC:L) for authenticated users make this a priority patch for affected organizations. The narrow affected version range (only Cassandra 5.0-5.0.6) and availability of a fixed version (5.0.7+) improve the remediation outlook. Organizations not using mTLS authentication or running versions outside 5.0.x are unaffected. The primary risk is for multi-tenant or shared Cassandra environments where low-privileged users legitimately have CREATE permissions but should be isolated from administrative functions.

An attacker with legitimate low-privilege access to a Cassandra 5.0.6 cluster using mTLS authentication obtains CREATE permission through normal application workflows or social engineering. The attacker generates their own X.509 certificate and uses the ADD IDENTITY command to associate their certificate with the SUPERUSER role or other administrative accounts. On subsequent connections, the attacker presents their certificate to the MutualTlsAuthenticator, which now authenticates them with superuser privileges. With complete administrative control, the attacker can exfiltrate all database contents, modify critical data, create backdoor accounts, or disrupt service availability across the distributed cluster. The network-accessible attack vector (AV:N) and low complexity (AC:L) enable remote exploitation without additional system access beyond the initial authenticated database connection.