Read the docs
TI-2026-35298 Aliases CVE-2026-47846

Hard-coded credentials in bitnami/cassandra

Priority MEDIUM 49CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path. Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00483 41st percentileScored 2026-11-07
Fix Fixed bitnami/cassandra (Bitnami): 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bitnamibitnami/cassandra4.0.0 to before 4.0.20-photon-5-r7; 4.1.0 to before 4.1.11-photon-5-r7; 5.0.0 to before 5.0.8-photon-5-r44.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4Patch availableCNA
  • bitnami/cassandra VendorBitnami Affected 4.0.0 to before 4.0.20-photon-5-r7; 4.1.0 to before 4.1.11-photon-5-r7; 5.0.0 to before 5.0.8-photon-5-r4 Fixed in 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4 Patch available CNA

Remediation

  • Fix · CNA bitnami/cassandra (Bitnami) Fixed in 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47846

References

Other 1

  • TI-2026-42460 Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints CVSS 3.1MEDIUM 4.2
  • TI-2021-05023 Hard-coded credentials in Bitnami Containers CVSS 3.1HIGH 7.3
  • TI-2026-35299 Hard-coded credentials in bitnami/mariadb-galera CVSS 3.1MEDIUM 5.3
  • TI-2026-18253 sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences