Back to Database
Status published
High
CVE-2025-26511
Cassandra-Lucene-Index allows bypass of Cassandra RBAC
Vulnerability Description
Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC and escalate their privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-26511
Credits & Attribution
No credits recorded in the NVD database.
References
More from NetApp
View All →CVE-2025-26517
CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium
5.4
CVE-2025-26516
CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium
5.3
CVE-2025-26515
CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
High
7.5
CVE-2025-26514
CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium
6.4
CVE-2025-26513
The installer for SAN Host Utilities for Windows versions prior...
High
7
Affected Vendor
NetApp
View all reports →Affected Software
Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin
Vulnerable Versions:
4.0-rc1-1.0.0, 4.1.2-1.0.0
Timeline
Official Publish:
February 13th, 2025
Last Modified:
January 22nd, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H