TI-2026-21742 Aliases CVE-2026-27315 GHSA-fh34-c629-p8xj

Apache Cassandra: cqlsh history sensitive information leak

LOW 24CWE-532Published 2026-04-07 · Updated 2026-04-09

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via ~/.cassandra/cqlsh_history local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description: Cassandra's command-line tool, cqlsh, provides a command history feature that allows users to recall previously executed commands using the up/down arrow keys. These history records are saved in the ~/.cassandra/cqlsh_history file in the user's home directory. However, cqlsh does not redact sensitive information when saving command history. This means that if a user executes operations involving passwords (such as logging in or creating users) within cqlsh, these passwords are permanently stored in cleartext in the history file on the disk.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00169 6th percentileScored 2026-11-07

Fix Fixed org.apache.cassandra:cassandra-all (Maven): 4.0.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Cassandra	4.0 – 4.0.19	—	No fix listed	CNA
—	org.apache.cassandra:cassandra-all (Maven)	4.0 to before 4.0.20	4.0.20	Patch available	GHSA-fh34-c629-p8xj

Apache Cassandra VendorApache Affected 4.0 – 4.0.19 Fixed in — No fix listed CNA
org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 4.0 to before 4.0.20 Fixed in 4.0.20 Patch available GHSA-fh34-c629-p8xj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:cassandra::::::::	4.0.0 to before 4.0.20	Vulnerable	Apache

cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.0.20 Vulnerable ·Apache

Remediation

Fix · GHSA-fh34-c629-p8xj org.apache.cassandra:cassandra-all (Maven) Fixed in 4.0.20 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-27315
2026-10-03 Alias added: GHSA-fh34-c629-p8xj

References

Patch 1

https://issues.apache.org/jira/browse/CASSANDRA-21180

Advisory 3

Other 1

https://github.com/apache/cassandra

TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
TI-2021-20121 Remote code execution for scripted UDFs CVSS 3.1CRITICAL 9.1
TI-2019-02233 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent… CVSS 3.1MEDIUM 5.9
TI-2018-05793 Missing authentication in Apache Cassandra CVSS 3.0CRITICAL 9.8
TI-2016-04292 handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before… CVSS 3.1HIGH 7.5
TI-2025-16827 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions CVSS 3.1HIGH 8.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences