Auth bypass in Apache Cassandra
CVE-2025-24860
Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer. Users with restricted data center access can update their own permissions via data control language (DCL) statements on affected versions. This issue affects Apache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 through 5.0.2 for both CassandraNetworkAuthorizer and CassandraCIDRAuthorizer. Operators using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer on affected versions should review data access rules for potential breaches. Users are recommended to upgrade to versions 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
Vulnerability class: Broken Access Control
EPSS: 0.011 (63.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Apache Cassandra
- Apache Software Foundation Cassandra — versions 4.0.0, 4.1.0, 5.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-24860?
- CVE-2025-24860 is a medium-severity vulnerability in Apache Cassandra, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2025-02-04.
- How severe is CVE-2025-24860?
- Medium severity. CVSS v3 base score is 5.4 out of 10.