CVE-2026-27315Disclosure(apache / cassandra)

LOWCVSS 5.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via ~/.cassandra/cqlsh_history local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description: Cassandra's command-line tool, cqlsh, provides a command history feature that allows users to recall previously executed commands using the up/down arrow keys. These history records are saved in the ~/.cassandra/cqlsh_history file in the user's home directory. However, cqlsh does not redact sensitive information when saving command history. This means that if a user executes operations involving passwords (such as logging in or creating users) within cqlsh, these passwords are permanently stored in cleartext in the history file on the disk.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://issues.apache.org/jira/browse/CASSANDRA-21180

Vendor / third-party advisories

Weakness type (CWE)

CWE-532

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cassandra

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
3 total mentions across 1 day

Affected systems

Vendors

apache

Products

cassandra

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets5 URLs

By indicator

Full discourse3 posts

Open Source Security mailing list@oss_security185d
Disclosure
Apache Cassandra CVE-2026-27314: Privilege escalation via ADD IDENTITY authorization bypass https://www.openwall.com/lists/oss-security/2026/04/07/7 CVE-2026-27315: cqlsh history sensitive info leak https://www.openwall.com/lists/oss-security/2026/04/07/8 CVE-2026-32588: Authenticated DoS via ALTER ROLE Password Hashing https://www.openwall.com/lists/oss-security/2026/04/07/9
Post summary
The passage announces three new Apache Cassandra CVEs, providing brief technical details for each, but no PoC, exploit code, patch information, or evidence of active exploitation.
01072698
4.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds185d
General
CVE-2026-27315 CVE-2026-27315 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27315
Post summary
The post merely lists the CVE ID twice and provides a link to a vulnerability details page, with no additional technical or operational context.
0000042
4.0K followersView on X
CVE@CVEnew185d
Disclosure
CVE-2026-27315 Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via ~/.cas… https://www.cve.org/CVERecord?id=CVE-2026-27315
Post summary
The post announces CVE‑2026‑27315, describing an information‑leak vulnerability in Apache Cassandra 4.0’s cqlsh that could expose stored passwords, and provides a link to the CVE record.
00000158
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	cassandra	-	-	-

Explore more

Back to dashboard apache CVEs cassandra vulnerabilities