Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions

Vulnerability

Overview

CVE-2025-24860 is an incorrect authorization vulnerability in Apache Cassandra's CassandraNetworkAuthorizer and CassandraCIDRAuthorizer. These components are designed to restrict user access to specific datacenters or IP/CIDR groups, but a flaw allows users with restricted permissions to bypass these controls. The root cause lies in how permission updates are handled: users can modify their own permissions using Data Control Language (DCL) statements, effectively granting themselves access to network regions they should not be able to reach [1][3].

Exploitation

An attacker who already has a limited Cassandra account (e.g., restricted to a single datacenter) can exploit this vulnerability by issuing DCL statements to alter their own authorization rules. No additional authentication or network position is required beyond the initial credentials. The attack surface is internal to the Cassandra cluster, as the authorizer checks are performed server-side when processing DCL commands [3].

Impact

Successful exploitation allows an attacker to gain unauthorized access to other datacenters or IP/CIDR groups within the same Cassandra cluster. This could lead to data exposure, privilege escalation, or lateral movement within the cluster, depending on the network segmentation and data sensitivity [1].

Mitigation

Apache has released fixed versions: 4.0.16, 4.1.8, and 5.0.3. Operators using affected versions (4.0.0–4.0.15, 4.1.0–4.1.7, 5.0.0–5.0.2) should upgrade immediately. As a workaround, administrators should review existing data access rules for potential breaches and consider restricting DCL permissions for untrusted users [1][3].