apache/cassandra · error · InvalidRequestException

Invalid CIDR group(s)

Error message

Invalid CIDR group(s): %s. Available CIDR Groups are: %s

What it means

Thrown by CIDRPermissions.validate when a role management statement references CIDR group names that are not registered with the CIDR authorizer's mapping manager. The message lists the offending groups and the set of groups that actually exist, so the mismatch is between what the statement names and what getAvailableCidrGroups() returns.

Solutions

1. Register the missing CIDR groups with the CIDR authorizer before referencing them in role statements
2. Remove or correct misspelled CIDR group names in the role's cidrs option
3. Re-list available groups (the message's second placeholder) and reissue the statement using only those names

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/CIDRPermissions.java:125 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/71f2b5c00ecada60. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/CIDRPermissions.java:125

            return subset.hashCode();
        }

        public String toString()
        {
            StringJoiner joiner = new StringJoiner(", ");
            subset.forEach(joiner::add);
            return joiner.toString();
        }

        public void validate()
        {
            Set<String> availableCidrGroups = DatabaseDescriptor.getCIDRAuthorizer()
                                                                .getCidrGroupsMappingManager()
                                                                .getAvailableCidrGroups();
            Set<String> unknownCidrGroups = Sets.difference(subset, availableCidrGroups);
            if (!unknownCidrGroups.isEmpty())
            {
                throw new InvalidRequestException("Invalid CIDR group(s): " + subset + ". Available CIDR Groups are: "
                                                  + availableCidrGroups);
            }
        }
    }

    private static final CIDRPermissions ALL = new CIDRPermissions()
    {
        public boolean canAccessFrom(Set<String> cidrGroup)
        {
            return true;
        }

        public boolean restrictsAccess()
        {
            return false;
        }

        public Set<String> allowedCIDRGroups()

View on GitHub (pinned to 88fd0f6a0e)