CVE-2025-26467
📋 TL;DR
This CVE describes a privilege escalation vulnerability in Apache Cassandra where a user with MODIFY permission on all keyspaces can gain superuser privileges by performing unsafe actions on system resources. This specifically affects Apache Cassandra 4.0.16 due to an incorrect fix for CVE-2025-23015. Organizations using Cassandra 4.0.16 with users granted broad MODIFY permissions are at risk.
💻 Affected Systems
- Apache Cassandra
📦 What is this software?
Cassandra by Apache
Cassandra by Apache
Cassandra by Apache
Cassandra by Apache
Cassandra by Apache
⚠️ Risk & Real-World Impact
Worst Case
An attacker with MODIFY permission on all keyspaces gains full superuser control over the Cassandra cluster, enabling data theft, data destruction, or complete system compromise.
Likely Case
Malicious or compromised users with existing MODIFY permissions escalate to superuser privileges, gaining unauthorized access to sensitive data and system configuration.
If Mitigated
With proper permission controls and no users granted MODIFY on all keyspaces, the attack surface is eliminated.
🎯 Exploit Status
Exploitation requires existing MODIFY permission on all keyspaces. The vulnerability is specific to privilege escalation from an already privileged user.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.17
Vendor Advisory: https://lists.apache.org/thread/xxj36rr4d6mzyqpld05dn8b9951hfpz7
Restart Required: Yes
Instructions:
1. Backup Cassandra configuration and data. 2. Download Apache Cassandra 4.0.17 from official sources. 3. Stop Cassandra service. 4. Replace installation with 4.0.17. 5. Start Cassandra service. 6. Verify version and functionality.
🔧 Temporary Workarounds
Revoke Broad MODIFY Permissions
allRemove MODIFY permission ON ALL KEYSPACES from all users and implement least privilege access controls.
REVOKE MODIFY ON ALL KEYSPACES FROM username;
🧯 If You Can't Patch
- Immediately audit and revoke MODIFY permission ON ALL KEYSPACES from all users, implementing least privilege principles.
- Implement network segmentation and monitoring for suspicious privilege escalation attempts on Cassandra nodes.
🔍 How to Verify
Check if Vulnerable:
Check Cassandra version with 'nodetool version' or 'cqlsh' connection. If version is exactly 4.0.16, the system is vulnerable.Check Version:
nodetool versionVerify Fix Applied:
After patching, verify version shows 4.0.17 or higher using 'nodetool version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in Cassandra system logs
- Unexpected MODIFY permission grants to users
- Suspicious queries targeting system keyspaces
Network Indicators:
- Unusual authentication patterns from users with MODIFY permissions
- Increased system keyspace access from non-admin users
SIEM Query:
source="cassandra.log" AND ("MODIFY" AND "ALL KEYSPACES") OR ("privilege escalation" OR "superuser")