CVE-2020-17516 Authentication Bypass in Apache Cassandra

What is CVE-2020-17516?

CVE-2020-17516 is a high-severity vulnerability in Apache Cassandra, published on 3 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Weakness: CWE-290

Which versions are affected by CVE-2020-17516?

5 open source packages ship an affected version, including org.apache.cassandra:cassandra-all and cassandra. It affects 1 product.

Products include Apache Cassandra.

How do I fix CVE-2020-17516?

Upgrade org.apache.cassandra:cassandra-all to a fixed version for your release line: 3.0.24 or 3.11.10.

Is CVE-2020-17516 being exploited?

There is no known exploitation of CVE-2020-17516 in the wild and no public exploit code.

Other vulnerabilities in Apache Cassandra

• CVE-2016-3427 Oracle Java SE and JRockit Unspecified Exploited Critical 9.8
• CVE-2018-8016 Missing Authentication for Critical Function in Apache Cassandra Critical 9.8
• CVE-2021-44521 Remote code execution for scripted UDFs Critical 9.1
• CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass High 8.8
• CVE-2025-26467 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only) High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-cassandra-2020-17516, GHSA-2vxm-vp4c-fjfw.