Vulnerability record · CVE-2021-44521 · published 11 February 2022
CVE-2021-44521: Apache Cassandra user-defined functions allow remote code execution
Apache · Cassandra
Apache Cassandra can execute arbitrary code on the host when user-defined functions, scripted UDFs, and non-threaded UDF execution are all enabled. The configuration is documented as unsafe, but clusters that enable it expose a code injection path through the UDF feature.
Description
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Automated analysis
high priorityCritical CVSS and high EPSS with public exploit detail, but exploitation requires an authenticated user with UDF creation rights and a non-default unsafe configuration.
What it is
Apache Cassandra can execute arbitrary code on the host when user-defined functions, scripted UDFs, and non-threaded UDF execution are all enabled. The configuration is documented as unsafe, but clusters that enable it expose a code injection path through the UDF feature.
Impact
An attacker with permission to create user-defined functions can run arbitrary code on the Cassandra host, leading to full compromise of the node and potentially the cluster.
Attack surface
Reachable over the network through the Cassandra interface by an authenticated user holding privileges to create user-defined functions; no user interaction is required. The flaw only applies when the three unsafe UDF settings are enabled.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.55, ~99th percentile) and public references include an exploit write-up, indicating active interest and available exploitation detail.
What to do
- Upgrade to a patched Apache Cassandra release per the vendor advisory.
- Disable enable_scripted_user_defined_functions and enable_user_defined_functions where UDFs are not required.
- Restrict CREATE FUNCTION permissions to trusted administrative roles only.
- Audit existing user-defined functions and remove any that are not explicitly required.
- Treat the documented unsafe UDF configuration as unsupported and avoid it in production.
Detection
- Monitor Cassandra logs for CREATE FUNCTION and UDF execution events, especially from non-administrative accounts.
- Alert on changes to cassandra.yaml settings for the three UDF-related flags.
- Hunt for unexpected child processes or outbound connections originating from Cassandra nodes.
- Review role and permission grants for CREATE FUNCTION on all clusters.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/02/11/4 | Mailing ListThird Party Advisory |
| https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ | ExploitMitigationThird Party Advisory |
| https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 | Issue TrackingMailing ListVendor Advisory |
| https://security.netapp.com/advisory/ntap-20220225-0001/ | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2022/02/11/4 | Mailing ListThird Party Advisory |
| https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ | ExploitMitigationThird Party Advisory |
| https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 | Issue TrackingMailing ListVendor Advisory |
| https://security.netapp.com/advisory/ntap-20220225-0001/ | Third Party Advisory |
Track CVE-2021-44521 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-44521), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
