CVE-2026-47846
Description
Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path. Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.
How to fix
- Bitnami bitnami/cassandra4.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Bitnami bitnami/cassandra | 4.0.0 ≤ v < 4.0.20-photon-5-r7, 4.1.0 ≤ v < 4.1.11-photon-5-r7, 5.0.0 ≤ v < 5.0.8-photon-5-r4 | 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, 5.0.8-photon-5-r4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.