Missing Authentication for Critical Function in Apache Cassandra

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-8016 · ADVISORY
• beobal/cassandra commit 28ee665 · WEB
• issues.apache.org/jira/browse/CASSANDRA-14173 · WEB
• lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066@%3Cuser.cassandra.apache.org%3E · WEB
• lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066%40%3Cuser.cassandra.apache.org%3E

org.apache.cassandra:cassandra-all のその他の脆弱性

• CVE-2026-32588中 6.5Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password change…
• CVE-2026-27315中 5.5Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed…
• CVE-2026-27314高 8.8Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission t…
• CVE-2025-26467高 8.8Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privil…
• CVE-2025-24860中 5.4Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to…