CVEs / CVE-2021-44521

CVE-2021-44521: Apache Software Foundation Apache Cassandra vulnerability

• critical 9.1 CVSS 3.1 (NVD)
• EPSS 58.8% chance of exploitation in the next 30 days, higher than 99% of CVEs (1 Nov 2026)
• Last changed at its sources 24 Oct 2026

Description

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

Affected and fixed versions

Package versions from GHSA-8ffc-79xg-29w8.

Exploitation

Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.

Severity

References

• CVE-2021-44521 on NVD
• CVE-2021-44521 on OSV
• http://www.openwall.com/lists/oss-security/2022/02/11/4 Mailing List, Third Party Advisory
• https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ Exploit, Mitigation, Third Party Advisory
• https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 Issue Tracking, Mailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220225-0001/ Third Party Advisory