CVE-2021-44521

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

• CWE-94
• CWE-732

• http://www.openwall.com/lists/oss-security/2022/02/11/4Mailing List, Third Party Advisory
• https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/Exploit, Mitigation, Third Party Advisory
• https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356Issue Tracking, Mailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220225-0001/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/02/11/4Mailing List, Third Party Advisory
• https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/Exploit, Mitigation, Third Party Advisory
• https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356Issue Tracking, Mailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220225-0001/Third Party Advisory

Published

Feb 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44514OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mi…9.8
• CVE-2021-44515Zoho ManageEngine Desktop Central is vulnerable to authentic…9.8
• CVE-2021-44518An issue was discovered in the eGeeTouch 3rd Generation Trav…6.8
• CVE-2021-44519In Citrix XenMobile Server through 10.12 RP9, there is an Au…8.8
• CVE-2021-4452The Google Language Translator plugin for WordPress is vulne…5.4
• CVE-2021-44520In Citrix XenMobile Server through 10.12 RP9, there is an Au…8.8
• CVE-2021-44522A vulnerability has been identified in SiPass integrated V2.…7.5
• CVE-2021-44523A vulnerability has been identified in SiPass integrated V2.…9.1
• CVE-2021-44524A vulnerability has been identified in SiPass integrated V2.…9.8
• CVE-2021-44525Zoho ManageEngine PAM360 before build 5303 allows attackers …9.8
• CVE-2021-44526Zoho ManageEngine ServiceDesk Plus before 12003 allows authe…9.8
• CVE-2021-44527A vulnerability found in UniFi Switch firmware Version 5.43.…6.5