PT-2026-30915 · Apache · Apache Cassandra+1

Ekaterina Dimitrova + 1 · Published 2026-04-07 · Updated 2026-05-18 · CVE-2026-27315

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 4.0 through 4.0.19

Description Apache Cassandra's command-line tool, cqlsh, saves command history in the ~/.cassandra/cqlsh history file. This file does not redact sensitive information, meaning passwords used in cqlsh commands are stored in cleartext on disk.

Recommendations Upgrade to version 4.0.20 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-CASSANDRA-2026-27315

CLEANSTART-2026-DD05788

CLEANSTART-2026-RN56220

CVE-2026-27315

GHSA-FH34-C629-P8XJ

Affected Products

Apache Cassandra

Cqlsh

References · 237

• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43642 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-0341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-12801 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1471 · Security Note
• https://osv.dev/vulnerability/BIT-cassandra-2026-27315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46120 · Security Note