Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing

This vulnerability allows an authenticated user to induce a denial of service condition within an Apache Cassandra cluster. By repeatedly changing their password, an attacker can trigger a cascade of operations that significantly increase query latency for all users. This can lead to application timeouts, service degradation, and potentially a complete outage. The impact is particularly severe in production environments with high query loads, as even a small number of malicious users could disrupt the entire cluster. While requiring authentication, the ease of password changes makes this a relatively low-effort attack vector.

Organizations running Apache Cassandra versions 4.0.0 through 5.0.6 are at risk, particularly those with a large number of users or applications relying on Cassandra for data storage. Shared hosting environments where multiple users have access to the Cassandra instance are also at increased risk.

• apache: Monitor Cassandra query latency using built-in metrics or external monitoring tools. Look for sudden and sustained increases in latency following password change events.

# Check Cassandra query latency using nodetool
nodetool cfstats | grep 'Read latency'

• apache: Examine Cassandra system logs for excessive password change requests originating from a single user or IP address.

# Filter Cassandra logs for password change events
zookeeper.log | grep 'Password changed for user'

1. 2026-04-07Disclosure

   disclosure

1. Reserviert2026-03-12
2. Veröffentlicht2026-04-07
3. Geändert2026-04-09
4. EPSS aktualisiert2026-04-15

The primary mitigation is to upgrade to a patched version of Apache Cassandra. Versions 4.0.20, 4.1.11, and 5.0.7 contain the fix. If immediate upgrade is not possible, consider implementing rate limiting on password change requests to reduce the frequency of triggering the vulnerability. Monitoring Cassandra query latency is crucial; unusual spikes should be investigated immediately. While a WAF cannot directly prevent this, it could be configured to detect and block suspicious patterns of password change requests. After upgrading, confirm the fix by simulating password changes and verifying that query latency remains within acceptable bounds.