PT-2026-50715 · Bitnami · Bitnami/Cassandra+1

Carrodher · Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-47846

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bitnami Cassandra container images versions 4.0.x prior to 4.0.20-photon-5-r7 Bitnami Cassandra container images versions 4.1.x prior to 4.1.11-photon-5-r7 Bitnami Cassandra container images versions 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3

Description Container initialization scripts fail to remove the built-in cassandra account when a custom administrator account is configured using the CASSANDRA USER environment variable. This allows a remote attacker who knows the default credentials to authenticate to the cluster as a full superuser, bypassing the intended account replacement.

Recommendations Update versions 4.0.x to 4.0.20-photon-5-r7 or later. Update versions 4.1.x to 4.1.11-photon-5-r7 or later. Update versions 5.0.x to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BIT-CASSANDRA-2026-47846

CVE-2026-47846

Affected Products

Bitnami/Cassandra

Apache Cassandra

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-47846 · Security Note
• https://osv.dev/vulnerability/BIT-cassandra-2026-47846 · Vendor Advisory
• https://github.com/bitnami/containers/security/advisories/GHSA-8q3j-37vg-8fc2 · Note
• https://twitter.com/VulmonFeeds/status/2067755489861992708 · Twitter Post
• https://twitter.com/CVEnew/status/2067717391002276311 · Twitter Post