Skip to main content
protocols.pageprotocols.page
9042

Port 9042 – Cassandra CQL

TCP

Port 9042 is the Apache Cassandra CQL (Cassandra Query Language) native protocol port. Applications connect to port 9042 to execute CQL queries, manage schemas, and perform CRUD operations. Cassandra ships with authentication disabled by default – enable PasswordAuthenticator before any network exposure.

Port Number

9042

Protocol

TCP

Service

Apache Cassandra Native Protocol

Range

IANA Registered (1024–49151)

Description

Cassandra's native protocol on port 9042 replaces the legacy Thrift interface (port 9160). All modern Cassandra drivers (Java, Python, Go, Node.js) connect via port 9042 using the CQL binary protocol. The protocol supports prepared statements, batch operations, paging, and lightweight transactions. Cassandra defaults to AllowAllAuthenticator (no authentication) and AllowAllAuthorizer (no access control). Any client that reaches port 9042 has full read/write/admin access to all keyspaces. Before exposing Cassandra beyond localhost: set authenticator: PasswordAuthenticator in cassandra.yaml, create application-specific roles with minimal permissions, and enable client-to-node encryption (client_encryption_options) for TLS on port 9042.

Security risks

  • 1Cassandra ships with AllowAllAuthenticator by default – any TCP connection to port 9042 has FULL read/write/DDL access to all keyspaces without any credentials
  • 2CVE-2021-44521: Apache Cassandra RCE via user-defined functions (UDFs) – crafted CQL on port 9042 escapes the UDF sandbox for arbitrary code execution. CVSS 9.1
  • 3CVE-2023-30601: Cassandra local privilege escalation – authenticated users on port 9042 can escalate to superuser via FQL/Audit log manipulation
  • 4Default superuser 'cassandra/cassandra' credentials – automated scanners exploit this within seconds of port 9042 internet exposure
  • 5CQL injection via parameterized query bypass – string concatenation in application code enables data extraction similar to SQL injection
  • 6Inter-node communication on port 7000/7001 trusts any Cassandra node – compromised port 9042 access can be leveraged to join a rogue node to the cluster
  • 7No query audit logging by default – data exfiltration via port 9042 leaves no forensic trail unless full query logging (FQL) is explicitly enabled

Firewall guidance

NEVER expose port 9042 to the internet. Cassandra's AllowAllAuthenticator default means instant full compromise. Before any network exposure: 1) Set authenticator: PasswordAuthenticator in cassandra.yaml, 2) Change default cassandra/cassandra credentials, 3) Enable client_encryption_options for TLS on port 9042, 4) Restrict to application server IPs only via iptables/security groups. For cross-DC replication, use port 7001 (TLS inter-node) and keep 9042 internal to each datacenter.

Diagnosis commands

Test if default credentials work – if this succeeds, the cluster is critically misconfigured

shell
cqlsh host 9042 -u cassandra -p cassandra -e 'DESCRIBE KEYSPACES;'

Check Cassandra cluster topology, node states, and data distribution (requires JMX on port 7199)

shell
nodetool status

Check if authentication logging is enabled – silent auth failures indicate brute force attempts

shell
nodetool getlogginglevels | grep auth

Audit Cassandra security configuration – authenticator, authorizer, and TLS settings

shell
grep -E 'authenticator|authorizer|client_encryption' /etc/cassandra/cassandra.yaml

List all Cassandra roles and their privileges – identify overprivileged accounts

shell
cqlsh host 9042 -e "SELECT role, can_login, is_superuser FROM system_auth.roles;"

Probe Cassandra native protocol on port 9042 for version info and cluster name disclosure

shell
nmap -sV -p 9042 --script cassandra-info target

Usage examples

Port 9042 – Cassandra CQL
shell
cqlsh host 9042 -u cassandra -p cassandra
nodetool enableauth (deprecated – edit cassandra.yaml instead)
cassandra.yaml: native_transport_port: 9042

Common services on this port

Apache Cassandra (distributed NoSQL database)DataStax Enterprise (commercial Cassandra)ScyllaDB (C++ Cassandra-compatible)Amazon Keyspaces (managed Cassandra)Astra DB (DataStax cloud Cassandra)

Related ports

9160

Cassandra Thrift (deprecated)

7000

Cassandra inter-node gossip

7001

Cassandra inter-node TLS

7199

Cassandra JMX monitoring

9142

Cassandra CQL TLS (native_transport_port_ssl)

History

Port 9042 was introduced in Cassandra 1.2 (2012) as the native binary protocol port, replacing the Thrift-based interface on port 9160. The CQL native protocol was designed for efficiency (binary framing, multiplexing, prepared statements) and became the exclusive client interface when Thrift was removed in Cassandra 4.0 (2021). The decision to ship without authentication by default (AllowAllAuthenticator) was a deliberate developer-experience choice that made Cassandra easy to prototype with but catastrophically insecure in production. Shodan consistently finds thousands of internet-exposed Cassandra instances on port 9042 with default credentials, leading to data breaches and ransomware attacks against unprotected clusters.

FAQ

How do I enable authentication on Cassandra port 9042?

1) Edit cassandra.yaml: set authenticator: PasswordAuthenticator and authorizer: CassandraAuthorizer. 2) Restart all nodes (rolling restart for zero downtime). 3) Login with default superuser: cqlsh -u cassandra -p cassandra. 4) Create a new superuser: CREATE ROLE admin WITH PASSWORD='strong' AND SUPERUSER=true AND LOGIN=true. 5) Drop or disable the default cassandra role. 6) Create application-specific roles with minimal GRANT permissions per keyspace.

How do I enable TLS encryption on Cassandra port 9042?

In cassandra.yaml, configure client_encryption_options: enabled: true, optional: false (force TLS), keystore: /path/keystore.jks, keystore_password: secret, require_client_auth: true (for mTLS). Alternatively, use port 9142 (native_transport_port_ssl) for TLS while keeping 9042 for localhost-only unencrypted connections. Generate keystores: keytool -genkey -keyalg RSA -alias cassandra -keystore keystore.jks.

What is the impact of CVE-2021-44521 on Cassandra?

CVE-2021-44521 allows remote code execution through User-Defined Functions (UDFs) in Cassandra 3.0-3.11.x and 4.0.x. An authenticated user who can execute CQL CREATE FUNCTION on port 9042 can escape the UDF sandbox and run arbitrary system commands as the cassandra OS user. Mitigation: upgrade to 3.0.26+, 3.11.12+, or 4.0.2+. Workaround: set enable_user_defined_functions: false in cassandra.yaml (default is false, but some deployments enable it for analytics).