CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

What is CVE-2026-27314?

CVE-2026-27314 is a high-severity vulnerability in Apache Cassandra, published on 7 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY.

Users are recommended to upgrade to version 5.0.7+, which fixes this issue.

Weakness: CWE-267

Which versions are affected by CVE-2026-27314?

2 open source packages ship an affected version, including org.apache.cassandra:cassandra-all. It affects 1 product.

Products include Apache Cassandra.

How do I fix CVE-2026-27314?

Upgrade org.apache.cassandra:cassandra-all to 5.0.7 or later.

Is CVE-2026-27314 being exploited?

There is no known exploitation of CVE-2026-27314 in the wild and no public exploit code.

Other vulnerabilities in Apache Cassandra

• CVE-2016-3427 Oracle Java SE and JRockit Unspecified Exploited Critical 9.8
• CVE-2018-8016 Missing Authentication for Critical Function in Apache Cassandra Critical 9.8
• CVE-2021-44521 Remote code execution for scripted UDFs Critical 9.1
• CVE-2025-26467 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only) High 8.8
• CVE-2025-23015 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-82676, GHSA-qxpc-96fq-wwmg, ROOT-APP-MAVEN-CVE-2026-27314.