CVE-2021-44521 Remote code execution for scripted UDFs
Attackers with UDF creation permissions can execute arbitrary code on Apache Cassandra hosts when unsafe scripted UDF settings are enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44521?
CVE-2021-44521 is a critical code injection vulnerability in Apache Cassandra, published on 11 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Which versions are affected by CVE-2021-44521?
7 open source packages ship an affected version, including org.apache.cassandra:cassandra-all and cassandra. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cassandra:cassandra-all Maven | All versions | 3.0.26 |
org.apache.cassandra:cassandra-all Maven | All versions | 3.0.26 |
org.apache.cassandra:cassandra-all Maven | From 3.11.0 | 3.11.12 |
org.apache.cassandra:cassandra-all Maven | From 3.11.0 | 3.11.12 |
org.apache.cassandra:cassandra-all Maven | From 4.0.0 | 4.0.2 |
org.apache.cassandra:cassandra-all Maven | From 4.0.0 | 4.0.2 |
1 more packages
cassandra Bitnami | From 3.0.0 | 3.0.26, 3.11.12, 4.0.2 |
Products include Apache Cassandra.
How do I fix CVE-2021-44521?
Upgrade org.apache.cassandra:cassandra-all to a fixed version for your release line: 3.0.26, 3.11.12 or 4.0.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-44521 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-44521 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Apache Cassandra
- CVE-2016-3427 Oracle Java SE and JRockit Unspecified
- CVE-2018-8016 Missing Authentication for Critical Function in Apache Cassandra
- CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
- CVE-2025-26467 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
- CVE-2025-23015 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Sources
Also known as BIT-cassandra-2021-44521, ECHO-2550-1834-d752, GHSA-8ffc-79xg-29w8, MINI-4jjc-74vc-3j6j, MINI-mxmp-hw8g-mq2f.