CVE-2020-17516: Apache Cassandra

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Affected products

• Apache Cassandra: from 2.1.0, up to and including 2.1.22; from 2.2.0, up to and including 2.2.19; from 3.0.0, up to and including 3.0.23; from 3.11.0, up to and including 3.11.9

Published 2021-02-03. Last modified 2026-06-17.