VulnSocial

CVE-2026-47846Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path. Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-06-18); latest day: 2
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01223Mentions · 2026-06-18: 3Mentions · 2026-06-20: 2Patch / Workaround · 2026-06-20: 1Technical Details · 2026-06-18: 2Technical Details · 2026-06-20: 206-1806-20
Signal classification3 categories
Disclosure
360.0%
General
120.0%
Patch
120.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-06-183
Disclosure2General1
2026-06-202
Disclosure1Patch1
Full discourse5 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨 Critical - Bitnami Cassandra Retained Default Superuser (CVE-2026-47846) Bitnami Cassandra container images fail to drop the built-in cassandra account in certain scenarios when a custom admin is set via CASSANDRA_USER. The default cassandra:cassandra superuser stays active as an unintended access path, giving a remote unauthenticated attacker full database access (CVSS 9.8, CWE-798). 👉 Affected: bitnami/cassandra 4.0.x < 4.0.20-photon-5-r7, 4.1.x < 4.1.11-photon-5-r7, 5.0.x < 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3 | Upgrade to the patched image

    Post summary

    The post announces a critical vulnerability (CVE-2026-47846) in Bitnami Cassandra that allows unauthenticated access via a retained default superuser, and urges users to upgrade to patched container images.

    0000081
    223 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-47846 - Critical supply chain attack in #Bitnami Cassandra #containers. Default superuser cassandra:cassandra retained after custom admin setup. #CVSS 9.8. #infosec #docker #cybersecurity #linux #ubuntu #k8s More FREE info: https://www.valtersit.com/cve/CVE-2026-47846/

    Post summary

    The tweet announces the CVE-2026-47846 supply chain vulnerability in Bitnami Cassandra containers, noting persistent default credentials and a CVSS score of 9.8, and links to a site for further details.

    0000065
    951 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-47846 Retained Default Superuser Vulnerability in Bitnami Cassandra Con... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47846 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The text links to a CVE-2026-47846 details page but offers no additional technical or exploit information.

    0000066
    4.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-47846 Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USE… https://www.cve.org/CVERecord?id=CVE-2026-47846 ----- Traducción: CVE-2026-47846 Las… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑47846 as a retained default superuser flaw in Bitnami Cassandra container images, with no PoC, exploit, or patch information provided.

    0000038
    82 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-47846 Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USE… https://www.cve.org/CVERecord?id=CVE-2026-47846

    Post summary

    The post announces that Bitnami Cassandra container images are affected by a retained default superuser vulnerability (CVE‑2026‑47846), but provides no PoC, exploit details, patch, or evidence of active exploitation.

    00000342
    57.6K followersView on X

Explore more

Back to dashboard