[
https://issues.apache.org/jira/browse/CASSANDRA-21219?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18071801#comment-18071801
]
Michael Semb Wever commented on CASSANDRA-21219:
------------------------------------------------
Committed as
https://github.com/apache/cassandra/commit/b584a435970e5125e1def5148d943c39569dc7af
> Disallow binding an identity to a superuser when the user is a regular user
> ---------------------------------------------------------------------------
>
> Key: CASSANDRA-21219
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21219
> Project: Apache Cassandra
> Issue Type: Bug
> Components: CQL/Interpreter
> Reporter: Francisco Guerrero
> Assignee: Francisco Guerrero
> Priority: Normal
> Fix For: 5.0.7, 6.0-alpha1, 6.0
>
>
> CVE-2026-27314 – https://www.cve.org/CVERecord?id=CVE-2026-27314
> Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using
> MutualTlsAuthenticator allows a user with only CREATE permission to associate
> their own certificate identity with an arbitrary role,including a superuser
> role, and authenticate as that role via ADD IDENTITY.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
