Executive brief
Bitnami Cassandra container images, used for deploying scalable databases, contain a security flaw where a default administrative account remains active even after a custom administrator is created. This allows an attacker to log in using well-known default credentials (cassandra/cassandra) to gain full control over the database. An exploit could lead to the theft of sensitive customer data, unauthorized modification of records, or the complete deletion of database contents.
Technical details
A vulnerability in the Bitnami Cassandra container initialization script (CWE-798) occurs when the CASSANDRA_USER environment variable is used to define a custom administrator. While the script successfully creates the new user, it fails to drop the default 'cassandra' superuser account in certain scenarios. A remote attacker can connect to the Cassandra CQL port (default 9042) and authenticate using the default credentials 'cassandra:cassandra'. Successful exploitation provides full superuser privileges, enabling the attacker to read, modify, or delete all data and alter cluster topology. Users should upgrade to patched versions or manually execute 'DROP USER cassandra;' via the CQL shell.
Affected products
- Bitnami bitnami/cassandra < 4.0.20-photon-5-r7; < 4.1.11-photon-5-r7; < 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
- 2026-06-18: patched