CA
Product
Cassandra
On CISA KEVExploited in the wild
16
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 6Low 0
Watch
Add Cassandra to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3427 In wildKEV | 9.8 | Apr 21 | Oracle Java SE and JRockit Unspecified Vulnerability Affected: 2.1.0 before 2.1.22; 2.2.0 before 2.2.18; 3.0.0 before 3.0.22; 3.11.0 before 3.11.8; 4.0.0 |
| CVE-2018-8016 | 9.8 | Jun 28 | The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute… Affected: 3.8 through 3.11.1 |
| CVE-2021-44521 | 9.1 | Feb 11 | When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true… Affected: 3.0.0 before 3.0.26; 3.11.0 before 3.11.12; 4.0.0 before 4.0.2 |
| CVE-2026-27314 | 8.8 | Apr 7 | Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate… Affected: 5.0.0 before 5.0.7 |
| CVE-2025-26467 | 8.8 | Aug 25 | Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra Affected: 3.0.0 before 3.0.31; 3.11.0 before 3.11.18; 4.0.0 before 4.0.17; 4.1.0 before 4.1.8; 5.0.0 before 5.0.3 |
| CVE-2025-23015 | 8.8 | Feb 4 | Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra Affected: 3.0.0 before 3.0.31; 3.1 before 3.11.18; 4.0.0 before 4.0.16; 4.1.0 before 4.1.8; 5.0.0 before 5.0.3 |
| CVE-2023-30601 | 7.8 | May 30 | Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra:… Affected: 4.0.0 before 4.0.10; 4.1.0 before 4.1.2 |
| CVE-2020-17516 | 7.5 | Feb 3 | Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted… Affected: 2.1.0 through 2.1.22; 2.2.0 through 2.2.19; 3.0.0 through 3.0.23; 3.11.0 through 3.11.9 |
| CVE-2016-4970 | 7.5 | Apr 13 | handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop) Affected: 3.11.4 |
| CVE-2026-32588 | 6.5 | Apr 7 | Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes Affected: 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 5.0.0 before 5.0.7 |
| CVE-2020-13946 | 5.9 | Sep 1 | In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or… Affected: before 2.1.22; 2.2.0 before 2.2.18; 3.0.0 before 3.0.22; 3.11.0 before 3.11.8; 4.0.0; 4.0.0; +3 more |
| CVE-2019-2684 | 5.9 | Apr 23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 2.1.0 before 2.1.22; 2.2.0 before 2.2.18; 3.0.0 before 3.0.22; 3.11.0 before 3.11.8; 4.0.0 |
| CVE-2026-27315 | 5.5 | Apr 7 | Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via… Affected: 4.0.0 before 4.0.20 |
| CVE-2025-24860 | 5.4 | Feb 4 | Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer… Affected: 4.0.0 before 4.0.16; 4.1.0 before 4.1.8; 5.0.0 before 5.0.3 |
| CVE-2024-27137 | 5.3 | Feb 4 | In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a… Affected: 4.0.2 before 4.0.15; 4.1.0 before 4.1.8; after 5.0.0 before 5.0.3; 5.0.0; 5.0.0; 5.0.0; +1 more |
| CVE-2015-0225 | – | Apr 3 | The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +32 more |
Showing 16