CVE-2020-17516: apache cassandra Authentication Bypass by Spoofing
Vulnerability summary
CVE-2020-17516 is a high (CVSS 7.5) Authentication Bypass by Spoofing vulnerability in apache cassandra. EPSS estimates a 1.96% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 03-02-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.96%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 1.93% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Apache1 product
- cassandra≥ 2.1.0, ≤ 2.1.22 | ≥ 2.2.0, ≤ 2.2.19 | ≥ 3.0.0, ≤ 3.0.23 | ≥ 3.11.0, ≤ 3.11.9
Org.apache.cassandra1 product
- cassandra-all≥ 2.1.0, < 3.0.24 | ≥ 3.11.0, < 3.11.10
2 vendors · 2 products
References
11 links- mail-archives.apache.org/mod_mbox/…X Refsource CONFIRM
