lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Apache Cassandra

Apache Software Foundationdatabase3 credentials

Credentials3 documented
01

PasswordAuthenticator Role Password

apache-cassandra / password-authenticator-role

Cassandra PasswordAuthenticator uses username/password pairs and stores usernames and hashed passwords in system_auth.roles.

user definedsecretusername/password

Looks like

pattern
pattern

Cassandra CQL role password assignment

(?i)CREATE\s+ROLE\s+\S+\s+WITH\s+PASSWORD\s*=\s*'[^'\r\n]+'
pattern

Cassandra CQL role password change statement

(?i)ALTER\s+ROLE\s+\S+\s+WITH\s+PASSWORD\s*=\s*'[^'\r\n]+'

Location

database
system_auth.roles

Cassandra system_auth table storing role names and hashed passwords

config file
cassandra.yaml, cqlshrc, ~/.cassandra/cqlshrc

Server auth settings and client-side CQL shell credentials

secret store

Kubernetes Secrets, cloud secret managers, CI/CD variables, and password vault entries

source code

Application connection config, migration scripts, tests, and accidentally committed credentials

logs

Failed authentication traces, driver debug logs, and CI output

public interface
tcp/9042

Cassandra native transport login endpoint

02

AllowAllAuthenticator / AllowAllAuthorizer Configuration

apache-cassandra / cassandra-yaml-auth-disabled

Cassandra AllowAllAuthenticator performs no checks and AllowAllAuthorizer allows any action to any user.

no authuser definedcontext dependentother

Unauthenticated access

open default
no authentication required
username
none
password
none

Looks like

pattern
pattern

cassandra.yaml setting that disables authentication checks

authenticator:\s*(?:AllowAllAuthenticator|org\.apache\.cassandra\.auth\.AllowAllAuthenticator)
pattern

cassandra.yaml setting that disables authorization checks

authorizer:\s*(?:AllowAllAuthorizer|org\.apache\.cassandra\.auth\.AllowAllAuthorizer)

Location

config file
cassandra.yaml

Cassandra server configuration controlling authentication and authorization backends

source code

Helm charts, container images, Ansible roles, and committed Cassandra configs

image

VM or container images containing insecure cassandra.yaml settings

Notes

This is absence of authentication/authorization, not a blank password.

03

TLS Keystore / Truststore Password

apache-cassandra / tls-keystore-password

Cassandra supports node-to-node and client encryption using Java keystores and truststores. cassandra.yaml references keystores, truststores, and their passwords.

user definedsecretpassword

Looks like

pattern
pattern

Cassandra YAML keystore or truststore password assignment

(?:keystore_password|truststore_password):\s*[^\s#]+

Location

config file
cassandra.yaml

server_encryption_options and client_encryption_options keystore/truststore passwords

secret store

Kubernetes Secrets, Java keystore stores, cloud secret managers, and deployment vaults

source code

Helm values, Docker Compose files, Ansible inventories, and committed TLS config

logs

Startup logs and troubleshooting output that include TLS option dumps

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.