CVE-2026-27315

Katalog CVE

CVSS 5.5 · Medium EPSS 0,19%

Kerentanan Insertion of Sensitive Information into Log File pada apache cassandra. Skor CVSS 3.1 5.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via  ~/.cassandra/cqlsh_history local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description: Cassandra's command-line tool, cqlsh, provides a command history feature that allows users to recall previously executed commands using the up/down arrow keys. These history records are saved in the ~/.cassandra/cqlsh_history file in the user's home directory. However, cqlsh does not redact sensitive information when saving command history. This means that if a user executes operations involving passwords (such as logging in or creating users) within cqlsh, these passwords are permanently stored in cleartext in the history file on the disk.

Rincian

Terbit di NVD

7 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://issues.apache.org/jira/browse/CASSANDRA-21180 issue tracking · patch · advisory vendor
• https://lists.apache.org/thread/ft77zrk2mzt8qsch4g6jqjj4901d22k3 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/07/8 mailing list · advisory pihak ketiga