Executive brief
Microsoft Azure Managed Instance for Apache Cassandra, a cloud-hosted database service, contains a vulnerability that could allow an authorized user to execute malicious code. An attacker with basic access to the service could potentially take control of the underlying infrastructure, leading to data theft or service disruption. This issue is particularly serious because it allows an attacker to move beyond the database environment to impact other parts of the cloud system.
Technical details
A critical vulnerability exists in Azure Managed Instance for Apache Cassandra due to improper access control and improper input validation (CWE-20). An attacker with low-privileged credentials (PR:L) can exploit this flaw over the network to achieve remote code execution. The vulnerability is characterized by a scope change (S:C), indicating that an exploit can impact components beyond the immediate security scope of the Cassandra instance. While the attack requires minimal complexity, it does require some form of user interaction (UI:R) to succeed. Microsoft has addressed this issue in the managed service environment.
Affected products
- Microsoft Azure Managed Instance for Apache Cassandra All versions prior to June 2026 update
Timeline
- 2026-05-07: advisory: Initial advisory published by Microsoft
- 2026-06-01: other: Advisory updated to clarify access control and input validation details