CVE-2026-27314

CVE-2026-27314 is a privilege escalation vulnerability in Apache Cassandra 5.0 that affects deployments using mutual TLS authentication (MutualTlsAuthenticator). An authenticated user with only CREATE permissions can exploit the ADD IDENTITY command to associate their certificate identity with arbitrary roles, including superuser accounts, effectively bypassing access controls. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network attack vector, low complexity, and low privilege requirements. Once exploited, the vulnerability grants an attacker high confidentiality, integrity, and availability impact, as they can authenticate as privileged roles and perform unauthorized administrative actions. The attack requires only user-level access and no additional user interaction. There is no evidence of active exploitation in the wild, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Community attention appears limited based on the low EPSS score. Apache has released version 5.0.7 and later to remediate this issue, and organizations should prioritize upgrading to patch this privilege escalation path in their Cassandra environments.