Port 7199 – Cassandra JMX

TCP

Port 7199 is the Apache Cassandra JMX (Java Management Extensions) monitoring port. JMX on port 7199 exposes Cassandra metrics, thread dumps, and management operations. Unauthenticated JMX enables remote code execution via MBean deserialization – never expose port 7199 beyond localhost or a management network.

Port Number

7199

Protocol

TCP

Service

Apache Cassandra JMX

Range

IANA Registered (1024–49151)

Description

Apache Cassandra uses port 7199 for JMX-based monitoring and management. The nodetool command-line utility connects to port 7199 to execute operations like nodetool status, nodetool repair, and nodetool snapshot. Monitoring tools (Prometheus JMX Exporter, Datadog) also scrape metrics from this port. JMX without authentication and TLS is a well-known remote code execution vector. Attackers who reach port 7199 can invoke arbitrary MBeans, load classes, and execute system commands. Cassandra versions before 4.0 ship with JMX authentication disabled by default. Enable JMX authentication in cassandra-env.sh, restrict to localhost, and use jmxremote.access/jmxremote.password files. Better: use the Prometheus JMX exporter as a local agent and expose only the metrics HTTP endpoint.

Security risks

1CVE-2020-13946: Apache Cassandra RCE via JMX – unauthenticated JMX on port 7199 allows remote code execution through deserialization of untrusted data in JMX ObjectNames (CVSS 5.9, fixed 2.1.22/3.0.26/3.11.12/4.0.2)
2JMX MLet RCE: attackers connect to unauthenticated JMX (port 7199), load a malicious MBean via javax.management.loading.MLet from a remote URL, and execute arbitrary code as the Cassandra process user. Tools: mjet, sjet, beanshooter automate this attack chain
3nodetool dependency: nodetool (the primary Cassandra admin CLI) requires JMX connectivity on port 7199. Disabling JMX entirely breaks operational tooling – the fix is authentication + localhost binding, not removal
4Heap dump exposure: JMX allows triggering heap dumps (com.sun.management:type=HotSpotDiagnostic.dumpHeap) which contain all in-memory data including encryption keys, auth tokens, and cached row data
5MBean attribute manipulation: writable MBeans allow changing compaction throughput, flush thresholds, and read/write timeouts at runtime – an attacker can degrade performance to cause an outage without leaving obvious traces

Firewall guidance

Bind JMX to localhost only: add -Dcassandra.jmx.local.port=7199 to jvm.options (default since Cassandra 3.11). For remote JMX access, enable authentication and TLS: set com.sun.management.jmxremote.authenticate=true, com.sun.management.jmxremote.ssl=true in cassandra-env.sh. Never allow port 7199 from untrusted networks. Use SSH tunneling for remote nodetool: ssh -L 7199:localhost:7199 cassandra-node, then nodetool -h localhost.

Diagnosis commands

Test JMX connectivity and show cluster ring status

shell

nodetool -h localhost -p 7199 status

Verify JMX bind address (should be 127.0.0.1, not 0.0.0.0)

shell

ss -tlnp | grep 7199

Check if JMX is remotely accessible (should be refused if properly firewalled)

shell

nmap -sV -p 7199 target

Audit JMX configuration – look for authenticate=false or ssl=false

shell

grep -E 'jmx|remote' /etc/cassandra/cassandra-env.sh | grep -v '^#'

Usage examples

Port 7199 – Cassandra JMX

shell

nodetool -h localhost -p 7199 status
nodetool -h localhost -p 7199 repair
jconsole localhost:7199

Common services on this port

Apache CassandraDataStax EnterpriseScyllaDB (JMX compatibility layer)Cassandra Reaper (repair tool)

Related ports

9042

CQL native protocol (client-facing)

7000

Cassandra inter-node gossip

7001

Cassandra inter-node TLS

9160

Cassandra Thrift (deprecated)

History

Port 7199 was chosen as Cassandra's JMX port when JMX management was added in early versions. JMX (Java Management Extensions) is the standard Java monitoring/management protocol. Cassandra relies heavily on JMX for operational tooling – nodetool, OpsCenter, and Reaper all use it. The shift to localhost-only binding in 3.11 (2017) was a response to widespread exploitation of exposed JMX ports across Java applications.

FAQ

Can I disable JMX on Cassandra entirely?

Not recommended. nodetool (repair, compaction, status), DataStax OpsCenter, and Cassandra Reaper all require JMX. Instead: bind to localhost (cassandra.jmx.local.port=7199), enable authentication (jmxremote.password file), and use SSH tunneling for remote access. For monitoring, metrics-reporter-config can export to Prometheus without JMX exposure.

How do I enable JMX authentication on Cassandra?

In cassandra-env.sh: set LOCAL_JMX=no, then configure -Dcom.sun.management.jmxremote.authenticate=true, -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password. Create jmxremote.password (user pass) and jmxremote.access (user readwrite) files with chmod 400. Test: nodetool -u user -pw pass status.