Sensitive Information Exposure in Apache Cassandra's Command-Line Tool

CVE-2026-27315

What is CVE-2026-27315?

The command-line interface tool, cqlsh, associated with Apache Cassandra allows for command history retrieval. However, due to a lack of redaction for sensitive data, commands that include sensitive information like passwords are logged in plaintext in the ~/.cassandra/cqlsh_history file. This can lead to unauthorized access to passwords and other confidential data if the history file is accessed by malicious users. To mitigate this risk, it is recommended that users upgrade to Apache Cassandra version 4.0.20 or later, where this issue is addressed.

References