CVE Intelligence
Analysis AI-assisted

CVE-2026-47846: Bitnami Cassandra container images retain default superuser account

Bitnami Cassandra container images may leave the built-in cassandra superuser active after a custom administrator is configured via CASSANDRA_USER, creating an unintended access path with well-known default credentials. The CNA rates the issue critical (CVSS 3.1 score 9.8), and fixed image builds are listed for the 4.0, 4.1 and 5.0 branches.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-47846 affects Bitnami Cassandra container images. When operators set a custom administrator through the CASSANDRA_USER environment variable, the image's initialization script creates the new superuser but, in certain scenarios, does not remove the built-in cassandra account. The default superuser, with its widely known default credentials, therefore stays active alongside the intended administrator. The weakness is classified as CWE-798 (Use of Hard-coded Credentials). Details come from the Bitnami GitHub security advisory and the NVD entry.

Impact

The CNA (VMware) assigns a CVSS 3.1 base score of 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Anyone who can reach the Cassandra native protocol port of an affected container could authenticate as a superuser using default credentials, gaining full control over data and roles: reading, modifying or deleting keyspaces, creating new accounts, and disrupting availability. Exposure is highest where the database port is reachable from untrusted networks.

Affected products and versions

According to the record, the following Bitnami Cassandra container images are affected:

  • 4.0.x prior to 4.0.20-photon-5-r7
  • 4.1.x prior to 4.1.11-photon-5-r7
  • 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3

The issue concerns the container image initialization logic, not Apache Cassandra itself. Only deployments that configure a custom administrator via CASSANDRA_USER, and fall into the specific scenarios described by the vendor, are expected to be affected.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Because default credentials are trivial to try, the practical barrier to abuse is low once a vulnerable instance is reachable.

Remediation and mitigation

  • Update to a fixed image build: 4.0.20-photon-5-r7 or later, 4.1.11-photon-5-r7 or later, or 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3 or later, as indicated in the advisory.
  • Updating the image may not clean up a cassandra role already persisted in existing data volumes; review existing clusters and remove or disable the default cassandra superuser if it is still present, after confirming your custom administrator works.
  • If the default account must be kept temporarily, change its password to a strong unique value and revoke unnecessary privileges.
  • Restrict network access to Cassandra ports to trusted application hosts only; never expose them directly to the internet.
  • Rotate credentials and review data integrity on any instance that was reachable while the default account was active.

Detection guidance

  • Inventory running containers and Helm/Compose deployments that use Bitnami Cassandra images and compare their tags with the fixed builds.
  • Review the role list on each cluster for a cassandra role with superuser rights that should not exist.
  • Audit Cassandra authentication logs (and audit logging, where enabled) for logins as the cassandra user, especially from unexpected source addresses.
  • Look for unexplained role creation, permission grants or schema changes.

Limitations of the available information

The NVD status is "Awaiting Analysis", so no independent NVD scoring or CPE data is available yet. The record does not detail which exact scenarios cause the account to be retained, provides no EPSS or SSVC data, and lists no structured affected or fix entries beyond the description. Whether fixed images also remediate already-initialized persistent data is not stated and should be verified with the vendor advisory.

Frequently asked questions

What is CVE-2026-47846?

A flaw in Bitnami Cassandra container images where configuring a custom administrator via CASSANDRA_USER can leave the built-in cassandra superuser with default credentials active.

Which images are fixed?

The record lists 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, and 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3 as the first non-affected builds in their branches.

Is it being exploited?

It is not in the CISA KEV catalog and no confirmed exploitation appears in the sources consulted.

Is updating the image enough?

Not necessarily. Existing clusters may still hold the default role in persistent data, so verify the role list and remove or disable the cassandra superuser if present.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.