The Bitnami Cassandra container images have a retained default superuser vulnerability (CWE-798). When a custom administrator account is set using the CASSANDRA_USER environment variable, the container initialization script creates the new superuser but fails to drop the built-in 'cassandra' superuser account in certain scenarios. This leaves the default 'cassandra:cassandra' credentials active, which can be exploited to gain unauthorized superuser access. Affected versions include 4.0.x prior to 4.0.20-photon-5-r7, 4.1.x prior to 4.1.11-photon-5-r7, and 5.0.x prior to 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3. No official patch or remediation guidance is provided in the available data.

The vulnerability allows an attacker to use hard-coded default superuser credentials ('cassandra:cassandra') to gain unauthorized administrative access to the Cassandra database container. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying affected versions or ensure that the default 'cassandra' superuser account is manually disabled or removed after container initialization. Monitoring for unauthorized access attempts using default credentials is recommended.