CVE-2026-27314: 
Apache Cassandra vulnerability analysis and mitigation

CVE-2026-27314 is a privilege escalation vulnerability in Apache Cassandra 5.0 affecting deployments that use the MutualTlsAuthenticator (mTLS) authentication mechanism. A low-privileged authenticated user with only CREATE permission can exploit the ADD IDENTITY command to associate their own certificate identity with any arbitrary role — including a superuser role — and subsequently authenticate as that role. Affected versions are Apache Cassandra 5.0.0 through 5.0.6 (Maven package org.apache.cassandra:cassandra-all). The vulnerability was disclosed on April 7, 2026, and reported by Sho Odagiri of GMO Cybersecurity by Ierae, Inc. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, oss-security).

The root cause is classified as CWE-267 (Privilege Defined With Unsafe Actions): the ADD IDENTITY command in Cassandra's mTLS authentication flow does not properly enforce authorization checks, allowing a user with only CREATE permission to bind a certificate identity to any role, including roles with superuser privileges. The attack vector is network-based, requires low privileges (a valid account with CREATE permission), and no user interaction. The flaw is tracked internally as CASSANDRA-21219 and is specific to deployments using MutualTlsAuthenticator; standard (non-mTLS) Cassandra deployments are not affected (GitHub Advisory, oss-security).

Successful exploitation allows an authenticated attacker with minimal CREATE permissions to escalate to full superuser-level control over the Apache Cassandra database cluster. This grants complete access to all data (confidentiality impact: High), the ability to modify or delete any database content and configurations (integrity impact: High), and the potential to disrupt database availability (availability impact: High). The attack can be performed remotely over the network without any user interaction, and could enable lateral movement within environments where Cassandra stores sensitive application data (GitHub Advisory, oss-security).

1. Reconnaissance: Identify Apache Cassandra 5.0.0–5.0.6 instances configured with MutualTlsAuthenticator for mTLS authentication. Confirm the target is reachable over the network and that mTLS is enforced.
2. Obtain low-privilege access: Acquire or create a Cassandra account with at minimum CREATE permission, along with a valid client TLS certificate accepted by the cluster.
3. Identify target role: Enumerate existing roles in the cluster (e.g., using LIST ROLES) to identify a superuser role to impersonate.
4. Execute ADD IDENTITY: Issue an ADD IDENTITY command associating the attacker's own certificate identity with the target superuser role. Due to the authorization bypass, the CREATE permission is sufficient to perform this action without proper privilege checks.
5. Authenticate as superuser: Connect to the Cassandra cluster using the same client certificate, now authenticated as the superuser role, gaining full administrative control over the cluster (oss-security, GitHub Advisory).

• Logs: Cassandra audit log entries showing ADD IDENTITY commands issued by low-privileged users (those without AUTHORIZE or superuser rights), particularly associating certificate identities with high-privilege or superuser roles.
• Logs: Authentication log entries showing a low-privilege user's certificate being used to authenticate as a superuser role shortly after an ADD IDENTITY event.
• Network: Unexpected mTLS connections from client certificates previously associated with low-privilege accounts now presenting as superuser sessions.
• Database Activity: Unusual superuser-level operations (schema changes, role modifications, data exports) originating from accounts or certificates not normally associated with administrative activity.

The primary remediation is to upgrade Apache Cassandra to version 5.0.7 or later, which contains the fix for this issue (GitHub Advisory, oss-security). If immediate patching is not feasible, restrict CREATE permissions to only fully trusted users and audit all existing ADD IDENTITY associations for unauthorized bindings. Additionally, monitor Cassandra audit logs for suspicious ADD IDENTITY commands and anomalous superuser authentication events in mTLS environments.

The vulnerability was disclosed via the Apache security mailing list and oss-security by Michael Semb Wever on April 7, 2026, crediting Sho Odagiri of GMO Cybersecurity by Ierae, Inc. as the reporter (oss-security). The Apache project rated the severity as "low" in the oss-security disclosure, while NVD and GitHub Advisory Database assigned it a CVSS score of 8.8 (High), reflecting a discrepancy in vendor versus community severity assessment. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.