CVE-2025-26511: Cassandra-Lucene-Index Privilege Escalation

CVE-2025-26511 Overview

CVE-2025-26511 is an authorization bypass vulnerability affecting systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin. This vulnerability allows authenticated Cassandra users to remotely bypass Role-Based Access Control (RBAC) mechanisms and escalate their privileges within the database environment. The flaw exists in plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0 when installed into Apache Cassandra version 4.x.

Critical Impact

Authenticated attackers can bypass RBAC controls to gain unauthorized elevated privileges, potentially compromising data confidentiality, integrity, and availability across the entire Cassandra cluster.

Affected Products

• Instaclustr Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0
• Instaclustr Cassandra-Lucene-Index plugin versions 4.1.2-1.0.0 through 4.1.8-1.0.0
• Apache Cassandra version 4.x with the affected plugin installed

Discovery Timeline

• 2025-02-13 - CVE-2025-26511 published to NVD
• 2025-02-14 - Last updated in NVD database

Technical Details for CVE-2025-26511

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), indicating a fundamental flaw in how the Cassandra-Lucene-Index plugin validates and enforces access control decisions. The vulnerability allows authenticated users to circumvent the intended RBAC mechanisms implemented in Apache Cassandra, enabling them to perform actions beyond their assigned permissions.

The attack can be executed remotely over the network by any user with valid authentication credentials to the Cassandra cluster. No user interaction is required, and the attack complexity is low, making this vulnerability particularly dangerous in multi-tenant environments or systems where users have varying privilege levels.

Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of data within the affected Cassandra cluster. Attackers could access sensitive data they should not have permissions to read, modify or delete critical data, or disrupt database operations.

Root Cause

The root cause stems from improper authorization checks within the Cassandra-Lucene-Index plugin. The plugin fails to properly validate user permissions against the RBAC policies configured in Apache Cassandra before executing privileged operations. This incorrect authorization implementation allows authenticated users to bypass intended access restrictions and escalate their privileges within the system.

Attack Vector

The vulnerability is exploitable over the network (Attack Vector: Network) by authenticated users with low-level privileges. An attacker must first authenticate to the Cassandra cluster with valid credentials, after which they can exploit the authorization bypass to escalate privileges. The attack does not require user interaction and can be performed with low complexity.

The privilege escalation occurs when the vulnerable plugin processes requests without properly checking whether the authenticated user has sufficient permissions to perform the requested operation against the RBAC policies. For detailed technical information about the exploitation mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-26511

Indicators of Compromise

• Unusual privilege escalation patterns in Cassandra audit logs showing users accessing resources beyond their assigned roles
• Unexpected data access or modification activities from low-privileged accounts
• Queries or operations targeting Lucene indexes by users who should not have access to those resources
• Authentication events followed by operations inconsistent with the user's normal behavior or assigned permissions

Detection Strategies

• Enable and monitor Cassandra audit logging to track all authentication and authorization events
• Implement behavioral analytics to detect anomalous access patterns from authenticated users
• Review Cassandra role assignments and compare against actual data access patterns
• Deploy network monitoring to detect unusual query patterns targeting Lucene-indexed data

Monitoring Recommendations

• Configure alerting for any failed RBAC enforcement events in Cassandra logs
• Monitor for unusual data access patterns across Cassandra keyspaces, especially from recently authenticated sessions
• Implement continuous monitoring of privilege usage to detect escalation attempts
• Establish baseline behavior for authenticated users and alert on deviations

How to Mitigate CVE-2025-26511

Immediate Actions Required

• Inventory all Apache Cassandra 4.x installations to identify systems running the vulnerable Cassandra-Lucene-Index plugin versions
• Review current user access and privileges to identify potentially compromised accounts
• Implement additional network segmentation to limit access to Cassandra clusters from untrusted network segments
• Enable comprehensive audit logging if not already active to capture any exploitation attempts

Patch Information

Organizations should consult the GitHub Security Advisory for the latest patch information and upgrade to a fixed version of the Cassandra-Lucene-Index plugin. Affected versions include 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0.

Workarounds

• If patching is not immediately possible, consider temporarily disabling the Cassandra-Lucene-Index plugin until a secure version can be deployed
• Restrict network access to Cassandra clusters to trusted networks and authorized IP addresses only
• Implement additional authentication layers or multi-factor authentication for Cassandra access
• Apply the principle of least privilege by reviewing and minimizing user permissions across the cluster

# Verify installed Cassandra-Lucene-Index plugin version
# Check the plugin JAR file in the Cassandra lib directory
ls -la $CASSANDRA_HOME/lib/ | grep lucene

# Review Cassandra RBAC configuration
cqlsh -e "LIST ROLES;"
cqlsh -e "LIST ALL PERMISSIONS;"

# Enable audit logging in cassandra.yaml (if not already enabled)
# audit_logging_options:
#   enabled: true
#   logger: BinAuditLogger