Loading...
Skip to main content
GeekWala

CVE-2025-26511 — Vulnerability in...

HIGH

Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC

Published February 13, 2025Updated February 3, 2026Source: osv

Summary

**Summary / Details** Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.0-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC to access data and and escalate their privileges. **Affected Versions** - Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 - versions 4.1.0-1.0.0 through 4.1.8-1.0.0 when installed into Apache Cassandra version 4.x. **Required Configuration for Exploit** These are the conditions required to enable exploit: 1. Cassandra 4.x 2. Vulnerable version of the Cassandra-Lucene-Index plugin configured for use 3. Data added to tables 4. Lucene index created 5. Cassandra flush has run **Mitigation/Prevention** Mitigation requires dropping all Lucene indexes and stopping use of the plugin. Exploit will be possible any time the required conditions are met. **Solution** Upgrade to a fixed version of the Cassandra-Lucene-Index plugin. Review users in Cassandra to validate all superuser privileges.

Advisory Timeline

  • First published February 13, 2025 (606 days ago).
  • Last revised February 3, 2026 — 354 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update com.instaclustr:cassandra-lucene-index-plugin to 4.0.17-1.0.0 or later
<!-- Update pom.xml dependency version to 4.0.17-1.0.0 for com.instaclustr:cassandra-lucene-index-plugin -->
Maven
Update com.instaclustr:cassandra-lucene-index-plugin to 4.1.8-1.0.1 or later
<!-- Update pom.xml dependency version to 4.1.8-1.0.1 for com.instaclustr:cassandra-lucene-index-plugin -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
com.instaclustr:cassandra-lucene-index-plugin
maven
4.0.0-1.0.04.0.17-1.0.0
com.instaclustr:cassandra-lucene-index-plugin
maven
All versions4.1.8-1.0.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-26511?
Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2025-26511?
CVE-2025-26511 affects com.instaclustr:cassandra-lucene-index-plugin. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-26511 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-mrqp-q7vx-v2cx

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies