CVE-2025-26467
BaseFortify
Publication date: 2025-08-25
Last updated on: 2025-08-26
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | cassandra | From 3.0.0 (inc) to 3.0.31 (exc) |
| apache | cassandra | From 3.11.0 (inc) to 3.11.18 (exc) |
| apache | cassandra | From 4.0.0 (inc) to 4.0.17 (exc) |
| apache | cassandra | From 4.1.0 (inc) to 4.1.8 (exc) |
| apache | cassandra | From 5.0.0 (inc) to 5.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-267 | A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache Cassandra allows a user who has MODIFY permission on all keyspaces to escalate their privileges to superuser by performing unsafe actions on a system resource. Essentially, it means that someone with certain data modification rights can gain full administrative control over the Cassandra cluster.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with MODIFY permissions on all keyspaces to gain superuser privileges, potentially leading to unauthorized access, data breaches, or full control over the Cassandra cluster. This could compromise the integrity, confidentiality, and availability of your data and systems.
What immediate steps should I take to mitigate this vulnerability?
Review and restrict data MODIFY permissions on all keyspaces to prevent unauthorized privilege escalation. Specifically, avoid granting MODIFY permission ON ALL KEYSPACES to users unless absolutely necessary. For Apache Cassandra 4.0 series, upgrade to version 4.0.17 which contains the fix for this vulnerability. For other affected versions (3.0, 3.11, 4.1, and 5.0 series), follow the recommendations provided in CVE-2025-23015.