CVE-2026-47846 Details

A vulnerability exists in Bitnami Cassandra container images due to a retained default superuser account. When a custom administrator account is set using the CASSANDRA_USER environment variable, the initialization script creates the new superuser but may not remove the default cassandra account in some cases. This oversight keeps the cassandra:cassandra superuser active, providing an unintended access route. Remote attackers who know the default credentials can authenticate as a superuser, bypassing the intended account replacement. The vulnerability affects Bitnami Cassandra container images in versions 4.0.x prior to 4.0.20-photon-5-r7, 4.1.x prior to 4.1.11-photon-5-r7, and 5.0.x prior to 5.0.8-photon-5-r4 or 5.0.8-debian-12-r3.

Users should upgrade to a fixed Bitnami Cassandra container image version (4.0.20-photon-5-r7, 4.1.11-photon-5-r7, or 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3). Those on end-of-life branches should migrate to a supported branch. As a temporary measure, the built-in cassandra user can be manually dropped via the CQL shell after deployment. Additionally, network access to the Cassandra CQL port should be restricted to trusted networks using firewall rules or Kubernetes NetworkPolicies.