CVE-2026-32588
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Apache Cassandra 4.0, 4.1, and 5.0 allow an authenticated user to raise query latencies via repeated password changes (authenticated DoS over CQL). The issue is fixed in versions 4.0.20, 4.1.11, and 5.0.7.
Risk Assessment
An authenticated user can degrade cluster performance and cause denial of service for other users. It requires a valid account but can disrupt application availability.
Recommendation
Upgrade Apache Cassandra to version 4.0.20, 4.1.11, or 5.0.7 (or later). Restrict account privileges and monitor for unusual password change patterns.
Other vulnerabilities in Apache Cassandra
See all- CVE-2015-0225High
The default configuration in Apache Cassandra versions 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, allowing remote attackers to execute arbitrary Java code via an RMI request.
- CVE-2026-27315Medium
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh commands via the ~/.cassandra/cqlsh_history local file. Anyone with access to this file can read the cleartext credentials.
Original NVD description (English source)
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS