CVE-2026-27314 — Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

Description (CNA)

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are recommended to upgrade to version 5.0.7+, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Cassandra	affected 5.0 through 5.0.6

CWE

CWE-267

References

https://lists.apache.org/thread/zrng82ddy4rpsmfyk582v6hqxcqrbz7f

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/04/07/7

CISA-ADP

No English description supplied.

No references supplied.