A critical privilege escalation vulnerability in Apache Cassandra 5.0 enables authenticated users to gain unauthorized superuser access, posing a severe risk to database integrity.

This flaw involves an improper privilege definition (CWE-267) within the MutualTlsAuthenticator. An authenticated user with existing CREATE permissions can incorrectly associate their certificate identity with an arbitrary, highly privileged role via the ADD IDENTITY command.

The ability for a standard user to escalate privileges to a superuser level grants them unrestricted access to the database. This creates a high risk of total data compromise, unauthorized modification of sensitive records, and potential system-wide disruption. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate remediation to prevent complete database takeover.

Immediate Action: Upgrade all instances of Apache Cassandra to version 5.0.7 or higher to apply the necessary security patches.

Proactive Monitoring: Review audit logs for suspicious usage of the ADD IDENTITY command and monitor for unauthorized changes to user role assignments.

Compensating Controls: If an immediate upgrade is not feasible, restrict the CREATE permission for non-administrative users to prevent them from executing the vulnerable command.

Public Exploit Available: Unknown.

Given the severity of the privilege escalation and the potential for full administrative takeover of the database, this issue must be treated as a priority. Security teams should verify their current deployment versions immediately and schedule a maintenance window to apply the update to version 5.0.7. Failure to patch this vulnerability leaves the database environment exposed to malicious actors who may leverage legitimate user accounts to gain elevated control.