CVE-2026-27315: 
Apache Cassandra vulnerability analysis and mitigation

CVE-2026-27315 is a sensitive information leak vulnerability in the cqlsh command-line tool of Apache Cassandra 4.0 that allows local attackers to access plaintext passwords and other credentials stored in the ~/.cassandra/cqlsh_history file. The vulnerability affects Apache Cassandra versions 4.0.0 through 4.0.19 and was disclosed on April 7, 2026, by reporter Youlong Chen of the Institute of Computing Technology, Chinese Academy of Sciences. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 score of 6.9 (Moderate) (GitHub Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File): cqlsh saves all executed commands — including those containing passwords (e.g., CREATE USER, ALTER USER, or login commands) — to ~/.cassandra/cqlsh_history without redacting sensitive fields. This file persists on disk in cleartext and is accessible to any local user or process with read access to the affected user's home directory. No special privileges or network access are required beyond local filesystem access; the attacker simply needs to read the history file after a legitimate user has executed password-bearing commands in cqlsh (GitHub Advisory, Apache Jira).

Successful exploitation allows a local attacker to retrieve plaintext Cassandra credentials (usernames and passwords) from the history file, enabling unauthorized access to the Cassandra database. If credentials are reused across systems, this could facilitate lateral movement beyond the Cassandra environment. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss (GitHub Advisory, Openwall OSS-Sec).

1. Gain local access: Obtain local access to the system running Apache Cassandra 4.0.0–4.0.19, either through a compromised account, shared system access, or privilege escalation from another vulnerability.
2. Locate the history file: Navigate to the home directory of a user who operates cqlsh and access the file at ~/.cassandra/cqlsh_history.
3. Extract credentials: Read the history file (e.g., cat ~/.cassandra/cqlsh_history) and search for commands containing passwords, such as CREATE USER <username> WITH PASSWORD '<password>', ALTER USER, or cqlsh -u <user> -p <password> invocations.
4. Use extracted credentials: Authenticate to the Cassandra cluster or other systems using the recovered plaintext credentials, potentially enabling full database access or lateral movement (Openwall OSS-Sec, GitHub Advisory).

• File System: Unexpected read access to ~/.cassandra/cqlsh_history by users or processes other than the file owner; presence of the history file containing CREATE USER, ALTER USER, or password-bearing cqlsh commands in plaintext.
• Logs: OS-level audit logs (e.g., auditd) recording unauthorized open() or read() syscalls on ~/.cassandra/cqlsh_history by unexpected users or processes.
• Process: Unusual processes (e.g., shell scripts, grep, cat) accessing the .cassandra directory in a user's home folder outside of normal cqlsh usage patterns.

Upgrade to Apache Cassandra version 4.0.20, which resolves this issue by redacting sensitive information from command history. As interim mitigations: restrict filesystem permissions on ~/.cassandra/cqlsh_history (e.g., chmod 600) and on user home directories to prevent unauthorized access; audit existing history files for exposed credentials and rotate any compromised passwords; and consider clearing the history file (> ~/.cassandra/cqlsh_history) on affected systems. Monitoring for unauthorized access to this file via OS audit tools is also recommended (GitHub Advisory, Apache Jira).

The vulnerability was disclosed via the Apache security mailing list and the oss-security list by Michael Semb Wever on April 7, 2026, with credit to reporter Youlong Chen of the Institute of Computing Technology, Chinese Academy of Sciences. The severity was rated "low" by Apache in the oss-security disclosure, consistent with its local-only attack vector. No significant broader media coverage or notable community debate has been observed (Openwall OSS-Sec, Apache Mailing List).