Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-26511
CVE-2025-26511:
Java vulnerability analysis and mitigation
Overview
Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC and escalate their privileges (NVD, GitHub Advisory).
Technical details
The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The exploit requires specific conditions including: Cassandra 4.x installation, vulnerable version of the Cassandra-Lucene-Index plugin configured for use, data added to tables, Lucene index created, and Cassandra flush has been run (GitHub Advisory).
Impact
When successfully exploited, this vulnerability allows authenticated Cassandra users to bypass Role-Based Access Control (RBAC), potentially gaining unauthorized access to data and escalating their privileges to higher levels than intended (GitHub Advisory).
Mitigation and workarounds
Immediate mitigation requires dropping all Lucene indexes and stopping use of the plugin. For a permanent fix, users should upgrade to version 4.0.17-1.0.0 or 4.1.8-1.0.1 of the Cassandra-Lucene-Index plugin. After upgrading, it is recommended to review all users in Cassandra to validate superuser privileges (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management