Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC
Summary / Details Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.0-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC to access data and and escalate their privileges.
Affected Versions
- Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0
- versions 4.1.0-1.0.0 through 4.1.8-1.0.0 when installed into Apache Cassandra version 4.x.
Required Configuration for Exploit These are the conditions required to enable exploit:
- Cassandra 4.x
- Vulnerable version of the Cassandra-Lucene-Index plugin configured for use
- Data added to tables
- Lucene index created
- Cassandra flush has run
Mitigation/Prevention Mitigation requires dropping all Lucene indexes and stopping use of the plugin. Exploit will be possible any time the required conditions are met.
Solution
Upgrade to a fixed version of the Cassandra-Lucene-Index plugin.
Review users in Cassandra to validate all superuser privileges.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | com.instaclustr:cassandra-lucene-index-plugin | >= 4.0-rc1-1.0.0, < 4.0.17-1.0.0, >= 4.1.0-1.0.0, < 4.1.8-1.0.1 | 4.0.17-1.0.0, 4.1.8-1.0.1 |
Referencias
- https://github.com/instaclustr/cassandra-lucene-index/security/advisories/GHSA-mrqp-q7vx-v2cx
- https://nvd.nist.gov/vuln/detail/CVE-2025-26511
- https://github.com/instaclustr/cassandra-lucene-index/commit/44ab4b639c9354a6335f40b1cf6178c745c6e101
- https://github.com/instaclustr/cassandra-lucene-index/commit/94380b165bd3e597d3e22e47f8cc674ec7c7bf7f
- https://github.com/instaclustr/cassandra-lucene-index
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-288, CWE-863- Plataforma
- Java / Kotlin (Maven)
- Paquete
com.instaclustr:cassandra-lucene-index-plugin- Publicada
- 13.02.2025
- Actualizado
- 11.10.2026 12:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-mrqp-q7vx-v2cx - CC BY 4.0
Historial de vulnerabilidades: com.instaclustr:cassandra-lucene-index-plugin
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.