CVE-2026-47846CWE-798

Bitnami Cassandra container images are affected by a retained default superuser vulnerability

Critical · published June 18, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path.

Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-06-18T18:39Z
EPSS history
Timeline
  • 18 JUN 18:39Z
    Bitnami Cassandra container images are affected by a retained default superuser vulnerability
    cvelistv5