Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-26467

Good to know:

icon
icon

Date: August 25, 2025

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. Users in the 4.0 series are recommended to upgrade to version 4.0.17 which fixes the issue. Users from 3.0, 3.11, 4.1 and 5.0 series should follow recommendation from CVE-2025-23015.

Severity Score

Related Resources (5)

https://github.com/apache/cassandra
https://nvd.nist.gov/vuln/detail/CVE-2025-26467
https://lists.apache.org/thread/xxj36rr4d6mzyqpld05dn8b9951hfpz7
https://seclists.org/oss-sec/2025/q1/121
https://www.mend.io/vulnerability-database/CVE-2025-26467

Severity Score

Weakness Type (CWE)

Improper Privilege Management

CWE-269

Privilege Defined With Unsafe Actions

CWE-267

Top Fix

icon

Upgrade Version

Upgrade to version org.apache.cassandra:cassandra-all:4.0.17

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us