Error: invalid password hash encountered, rejecting user

Error message

Error: invalid password hash encountered, rejecting user

What it means

During login, PasswordAuthenticator.checkpw compares the supplied password against the stored bcrypt hash. BCrypt.checkpw throws on improperly formatted or corrupt hashes; this catch-all traps any such exception, logs a warning, and rejects the user by returning false instead of propagating an exception. Authentication fails for that user only.

Solutions

Re-create or ALTER the role to reset its password: ALTER ROLE <user> WITH PASSWORD = '<new>'; or DROP/CREATE ROLE.
Inspect the stored hash: SELECT role, salted_hash FROM system_auth.roles; and confirm it is a valid bcrypt string starting with $2a$ or $2b$.
Re-run the default superuser setup if the affected role is cassandra (node tool or fresh system_auth initialization).
Check provisioning/migration tooling that writes system_auth rows to ensure hashes are produced by the same BCrypt library.

Defensive patterns

Strategy: validation

Validate before calling

-- Check stored hashes are valid bcrypt strings before blaming the client
SELECT role, salted_hash, can_login FROM system_auth.roles;
-- salted_hash should match '^\\$2[aby]\\$\\d{2}\\$.{53}$'

Prevention

Only create/modify roles via CQL (CREATE/ALTER ROLE), never manual system_auth inserts.
Copy or migrate system_auth tables whole, not partially.
When provisioning users programmatically, generate hashes with the same BCrypt version Cassandra uses.
On login failures, check the hash format first before resetting credentials.

When it happens

Trigger: A row in system_auth.roles contains a salted_hash that is null, empty, truncated, not a bcrypt hash ($2a$/$2b$ prefix missing), or otherwise corrupt when authenticate() calls checkpw for that role.

Common situations: Role created/modified outside normal CQL (manual inserts into system_auth), failed migration between clusters, hand-copied auth tables where the hash was mangled, restoring only part of system_auth, or a password containing characters that broke an external provisioning script.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/f8fe5b39c8629e6a. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/PasswordAuthenticator.java:161

            return entries;
        };
    }

    public CredentialsCache getCredentialsCache()
    {
        return cache;
    }

    protected static boolean checkpw(String password, String hash)
    {
        try
        {
            return BCrypt.checkpw(password, hash);
        }
        catch (Exception e)
        {
            // Improperly formatted hashes may cause BCrypt.checkpw to throw, so trap any other exception as a failure
            logger.warn("Error: invalid password hash encountered, rejecting user", e);
            return false;
        }
    }

    /**
     * This is exposed so we can override the consistency level for tests that are single node
     */
    @VisibleForTesting
    UntypedResultSet process(String query, ConsistencyLevel cl)
    {
        return QueryProcessor.process(query, cl);
    }

    private AuthenticatedUser authenticate(String username, String password) throws AuthenticationException
    {
        String hash = cache.get(username);

        // intentional use of object equality

View on GitHub (pinned to 88fd0f6a0e)