Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-47846

Quick assessment

Affected
Bitnami bitnami/cassandra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bitnami Bitnami Cassandra是Bitnami公司开源的一套预构建容器镜像，用于在云原生环境中快速部署和管理分布式、高可用的 Apache Cassandra 数据库集群。 Bitnami Cassandra存在信任管理问题漏洞，该漏洞源于保留默认超级用户，当通过CASSANDRA_USER环境变量配置自定义管理员账户时，容器初始化脚本未能删除内置cassandra账户，导致默认超级用户账户作为非预期的访问路径保持活动状态。

CVSS 9.8 · Critical EPSS 0.48% · P40

Affected Version Matrix 3

VendorProduct Version RangeStatus
Bitnami bitnami/cassandra 4.0.0< 4.0.20-photon-5-r7 affected
4.1.0< 4.1.11-photon-5-r7 affected
5.0.0< 5.0.8-photon-5-r4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47846

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassandra account in certain scenarios. This leaves the default cassandra:cassandra superuser active as an unintended access path. Affected versions — Container image: 4.0.x prior to 4.0.20-photon-5-r7; 4.1.x prior to 4.1.11-photon-5-r7; 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
Bitnami Cassandra 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bitnami Bitnami Cassandra是Bitnami公司开源的一套预构建容器镜像，用于在云原生环境中快速部署和管理分布式、高可用的 Apache Cassandra 数据库集群。 Bitnami Cassandra存在信任管理问题漏洞，该漏洞源于保留默认超级用户，当通过CASSANDRA_USER环境变量配置自定义管理员账户时，容器初始化脚本未能删除内置cassandra账户，导致默认超级用户账户作为非预期的访问路径保持活动状态。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Bitnami bitnami/cassandra 4.0.0 ~ 4.0.20-photon-5-r7 -

II. Public POCs for CVE-2026-47846

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47846

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-47846 (1)

IV. Related Vulnerabilities

Same vendor: Bitnami
Same weakness: CWE-798

V. Comments for CVE-2026-47846

No comments yet

Leave a comment