Apache Cassandra: unrestricted deserialization of JMX authentication credentials
Priority LOW 24CWE-287Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorized operations. This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10. This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11. Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix Fixed Apache Cassandra (Apache Software Foundation): 4.0.15, 4.1.8, 5.0.3org.apache.cassandra:cassandra-all (Maven): 5.0.3, 4.1.8, 4.0.15
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Cassandra | 4.0.2 to before 4.0.15; 4.1.0 to before 4.1.8; 5.0-beta1 to before 5.0.3 | 4.0.15, 4.1.8, 5.0.3 | Patch available | CNA |
| — | org.apache.cassandra:cassandra-all (Maven) | 5.0-beta1 to before 5.0.3 | 5.0.3 | Patch available | GHSA-rgfx-7p65-3ff4 |
| — | org.apache.cassandra:cassandra-all (Maven) | 4.1.0 to before 4.1.8 | 4.1.8 | Patch available | GHSA-rgfx-7p65-3ff4 |
| — | org.apache.cassandra:cassandra-all (Maven) | 4.0.2 to before 4.0.15 | 4.0.15 | Patch available | GHSA-rgfx-7p65-3ff4 |
- Apache Cassandra VendorApache Affected 4.0.2 to before 4.0.15; 4.1.0 to before 4.1.8; 5.0-beta1 to before 5.0.3 Fixed in 4.0.15, 4.1.8, 5.0.3 Patch available CNA
- org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 5.0-beta1 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-rgfx-7p65-3ff4
- org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 4.1.0 to before 4.1.8 Fixed in 4.1.8 Patch available GHSA-rgfx-7p65-3ff4
- org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 4.0.2 to before 4.0.15 Fixed in 4.0.15 Patch available GHSA-rgfx-7p65-3ff4
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:* | 4.0.2 to before 4.0.15; 4.1.0 to before 4.1.8; after 5.0.0, before 5.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:cassandra:5.0.0:-:*:*:*:*:*:* | 5.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:cassandra:5.0.0:beta1:*:*:*:*:*:* | 5.0.0 beta1 | Vulnerable | Apache |
| cpe:2.3:a:apache:cassandra:5.0.0:rc1:*:*:*:*:*:* | 5.0.0 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:cassandra:5.0.0:rc2:*:*:*:*:*:* | 5.0.0 rc2 | Vulnerable | Apache |
- cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:* Versions 4.0.2 to before 4.0.15; 4.1.0 to before 4.1.8; after 5.0.0, before 5.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:cassandra:5.0.0:-:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:cassandra:5.0.0:beta1:*:*:*:*:*:* Versions 5.0.0 beta1 Vulnerable ·Apache
- cpe:2.3:a:apache:cassandra:5.0.0:rc1:*:*:*:*:*:* Versions 5.0.0 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:cassandra:5.0.0:rc2:*:*:*:*:*:* Versions 5.0.0 rc2 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Cassandra (Apache Software Foundation) Fixed in 4.0.15, 4.1.8, 5.0.3
- Fix · GHSA-rgfx-7p65-3ff4 org.apache.cassandra:cassandra-all (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-rgfx-7p65-3ff4 org.apache.cassandra:cassandra-all (Maven) Fixed in 4.1.8 Advisory →
- Fix · GHSA-rgfx-7p65-3ff4 org.apache.cassandra:cassandra-all (Maven) Fixed in 4.0.15 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 9 products
- A-MQ Clients 2
- Red Hat Data Grid 8
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27137
- 2026-10-03 Alias added: GHSA-rgfx-7p65-3ff4
References
More Apache Cassandra vulnerabilities
- TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-20121 Remote code execution for scripted UDFs CVSS 3.1CRITICAL 9.1
- TI-2019-02233 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent… CVSS 3.1MEDIUM 5.9
- TI-2018-05793 Missing authentication in Apache Cassandra CVSS 3.0CRITICAL 9.8
- TI-2016-04292 handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before… CVSS 3.1HIGH 7.5
- TI-2025-16827 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions CVSS 3.1HIGH 8.8
Sources
- CVE-2024-27137 · CVE Program
- CVE-2024-27137 · NVD
- FIRST EPSS
- GHSA-rgfx-7p65-3ff4 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-27137 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences