CVE-2026-27314
High · 8.8CVSS
8.8
EPSS
0.3%
Published
Apr 7, 2026
CISA due date
—
The record
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are recommended to upgrade to version 5.0.7+, which fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96390 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility… CWE-267
- CVE-2026-96371 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-96367 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
- CVE-2026-18858 IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from… CWE-267
- CVE-2026-10090 A flaw was found in the Application Subscription controller… CWE-267
- CVE-2026-6816 An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the… CWE-267
- CVE-2026-9560 Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on… CWE-267