CVE-2026-47846
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path. Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.
| CWE | CWE-798 |
| Vendor | bitnami |
| Product | bitnami/cassandra |
| Published | Jun 18, 2026 |
| Last Updated | Jun 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for bitnami bitnami/cassandra
Be the first to know when new critical vulnerabilities affecting bitnami bitnami/cassandra are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Bitnami / bitnami/cassandra
4.0.0 < 4.0.20-photon-5-r7 4.1.0 < 4.1.11-photon-5-r7 5.0.0 < 5.0.8-photon-5-r4