CVE-2026-47846 Hardcoded credentials in bitnami/cassandra
Attackers can use default credentials to gain superuser access in Bitnami Cassandra containers when custom admin accounts are configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47846?
CVE-2026-47846 is a critical vulnerability in bitnami/cassandra, published on 18 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path.
Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.
Weakness: CWE-798
Which versions are affected by CVE-2026-47846?
1 open source package ship an affected version, including cassandra.
| Package | Affected | Fixed in |
|---|---|---|
cassandra Bitnami | From 4.0.0 | 4.0.20-0, 4.1.11-0, 5.0.8-0 |
How do I fix CVE-2026-47846?
Upgrade cassandra to a fixed version for your release line: 4.0.20-0, 4.1.11-0 or 5.0.8-0.
Is CVE-2026-47846 being exploited?
There is no known exploitation of CVE-2026-47846 in the wild and no public exploit code.
Sources
Also known as BIT-cassandra-2026-47846.