CVE-2025-26467: 
Apache Cassandra vulnerability analysis and mitigation

CVE-2025-26467 is a privilege escalation vulnerability in Apache Cassandra classified as "Privilege Defined With Unsafe Actions" (CWE-267). A user with MODIFY permission on ALL KEYSPACES can escalate their privileges to superuser within a targeted Cassandra cluster by performing unsafe actions on a system resource. This advisory specifically covers Apache Cassandra 4.0.16, where the fix for the related CVE-2025-23015 was incorrectly applied, leaving that version still vulnerable; the broader issue also affects versions 3.0.30, 3.11.17, 4.1.7, and 5.0.2. It was published on August 25, 2025, with a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-267 (Privilege Defined With Unsafe Actions), where a legitimately granted permission — MODIFY on ALL KEYSPACES — can be leveraged to perform unintended privileged operations on Cassandra system resources, ultimately allowing privilege escalation to superuser. The vulnerability is exploitable over the network with low attack complexity and requires only low-level privileges (a valid Cassandra account with the MODIFY permission on all keyspaces), with no user interaction needed. CVE-2025-26467 is specifically a regression in the 4.0 series: the patch for the parent vulnerability CVE-2025-23015 was incorrectly applied to version 4.0.16, reintroducing the flaw in that release (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a low-privileged attacker to escalate to superuser within the targeted Cassandra cluster, resulting in high confidentiality, integrity, and availability impact across the entire cluster. A compromised superuser account can read, modify, or delete any data across all keyspaces, execute administrative commands, and potentially disrupt cluster operations. Operators who have granted MODIFY permission on all keyspaces should treat affected deployments as potentially fully compromised and audit access logs accordingly (GitHub Advisory).

1. Reconnaissance: Identify Apache Cassandra 4.0.16 instances accessible over the network using service discovery tools (e.g., Shodan, Censys) or internal network scanning targeting the default Cassandra native transport port (9042).
2. Obtain low-privilege credentials: Acquire or use an existing Cassandra account that has been granted MODIFY permission on ALL KEYSPACES — a permission that may be legitimately assigned to application service accounts.
3. Connect to the cluster: Use the cqlsh client or a Cassandra driver to authenticate to the cluster with the low-privilege account.
4. Perform unsafe actions on a system resource: Execute crafted CQL statements targeting Cassandra system keyspace resources in a manner that exploits the unsafe privilege boundary, leveraging the MODIFY permission to write to or manipulate system tables.
5. Achieve superuser escalation: The unsafe system resource modification results in the attacker's account being elevated to superuser status within the cluster.
6. Full cluster compromise: With superuser privileges, execute administrative commands, access all keyspaces and data, create backdoor accounts, or disrupt cluster availability (GitHub Advisory, Red Hat Bugzilla).

• Network: Unexpected connections to Cassandra native transport port (9042) from unusual source IPs or internal hosts not associated with known application services.
• Logs: Cassandra audit logs showing a low-privilege user account executing CQL operations against system keyspaces (e.g., system, system_auth) that are outside normal application behavior; sudden appearance of new superuser accounts in system_auth.roles.
• Access Patterns: A non-administrative user account querying or modifying system_auth tables; privilege changes reflected in system_auth.role_permissions or system_auth.roles not initiated by a known administrator.
• Process/Admin Activity: New superuser accounts created without corresponding change management records; unexpected administrative CQL commands (e.g., ALTER ROLE, CREATE ROLE WITH SUPERUSER = true) executed by non-admin users (GitHub Advisory).

Users running Apache Cassandra 4.0.16 should upgrade immediately to version 4.0.17, which correctly applies the fix. Users on the 3.0, 3.11, 4.1, and 5.0 series should follow the remediation guidance from CVE-2025-23015. As an interim workaround, operators should audit and restrict MODIFY permissions on ALL KEYSPACES, ensuring only strictly necessary accounts hold this permission, and limit network access to Cassandra clusters to trusted hosts only (GitHub Advisory, Apache Mailing List).

The vulnerability was noted on the Apache security announcement mailing list and picked up by the OSS-Security mailing list shortly after disclosure. Red Hat opened a tracking bug (BZ#2390786) and flagged it for review across multiple JBoss/EAP product teams. Community reaction has been relatively muted given the narrow scope (only 4.0.16 is specifically addressed by this CVE), with no significant media coverage or notable researcher commentary beyond standard advisory tracking (Red Hat Bugzilla, Apache Mailing List).