Apache Cassandra vulnerabilities

16 CVEs affecting Apache Cassandra, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-32588, published 2026-04-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2021-44521, published 2022-02-11. Critical severity, CVSS 9.1. EPSS: 57.5% chance of exploitation in the next 30 days. When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is…
CVE-2019-2684, published 2019-04-23. Medium severity, CVSS 5.9. EPSS: 37.6% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201.…
CVE-2016-4970, published 2017-04-13. High severity, CVSS 7.5. EPSS: 11.3% chance of exploitation in the next 30 days. handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
CVE-2015-0225, published 2015-04-03. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows…
CVE-2020-13946, published 2020-09-01. Medium severity, CVSS 5.9. EPSS: 3% chance of exploitation in the next 30 days. In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to…
CVE-2018-8016, published 2018-06-28. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via…
CVE-2020-17516, published 2021-02-03. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted…
CVE-2025-24860, published 2025-02-04. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or…
CVE-2025-23015, published 2025-02-04. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via…

Latest

CVE-2026-32588, published 2026-04-07. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20,…
CVE-2026-27315, published 2026-04-07. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via ~/.cassandra/cqlsh_history local file…
CVE-2026-27314, published 2026-04-07. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an…
CVE-2025-26467, published 2025-08-25. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via…
CVE-2024-27137, published 2025-02-04. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack…
CVE-2023-30601, published 2023-05-30. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through…