The Bitnami Cassandra container images have a retained default superuser vulnerability (CWE-798). When users configure a custom administrator account using the CASSANDRA_USER environment variable, the initialization script creates the new superuser but fails to delete the built-in 'cassandra' superuser account under certain conditions. This leaves the default 'cassandra:cassandra' credentials active, which can be exploited to gain unauthorized superuser access. Affected versions include 4.0.x prior to 4.0.20-photon-5-r7, 4.1.x prior to 4.1.11-photon-5-r7, and 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3. No official patch or remediation level is provided in the available data.

The vulnerability allows an attacker to use the default hard-coded superuser credentials 'cassandra:cassandra' to gain unauthorized superuser access to the Cassandra database container. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should verify that the default 'cassandra' superuser account is removed or disabled after creating a custom administrator account. Avoid deploying affected versions without additional access controls or compensating controls to restrict access to the default credentials.