apache/cassandra · error · UnauthorizedException

Only superusers are allowed to alter access from CIDR groups

Error message

Only superusers are allowed to alter access from CIDR groups.

What it means

Cassandra throws this UnauthorizedException when a non-superuser role attempts ALTER ROLE while specifying CIDR-group access (cidrPermissions). Only superusers may grant or revoke access from CIDR groups, as enforced in AlterRoleStatement.authorize.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java:113

    }

    public void authorize(ClientState state) throws UnauthorizedException
    {
        AuthenticatedUser user = state.getUser();
        boolean isSuper = user.isSuper();

        if (opts.getSuperuser().isPresent() && user.getRoles().contains(role))
            throw new UnauthorizedException("You aren't allowed to alter your own superuser " +
                                            "status or that of a role granted to you");

        if (opts.getSuperuser().isPresent() && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter superuser status");

        if (dcPermissions != null && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter access to datacenters.");

        if (cidrPermissions != null && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter access from CIDR groups.");

        // superusers can do whatever else they like
        if (isSuper)
            return;

        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions
        if (user.getName().equals(role.getRoleName()))
        {
            for (Option option : opts.getOptions().keySet())
            {
                if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option))
                    throw new UnauthorizedException(String.format("You aren't allowed to alter %s", option));
            }
        }
        else
        {
            // if not attempting to alter another role, ensure we have ALTER permissions on it
            super.checkPermission(state, Permission.ALTER, role);

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Log in as (or grant superuser to, via an existing superuser) a superuser role before altering CIDR group access
  2. Split the statement: perform non-CIDR attribute changes with the current role and delegate only CIDR changes to a superuser
  3. Enable and configure CIDR authorization in cassandra.yaml and verify the executing role's superuser status with LIST ROLES

Example fix

// before
ALTER ROLE service_role WITH CIDR GROUPS = {'office_net'};
// after
-- run as superuser, e.g. cassandra or another super role
ALTER ROLE service_role WITH CIDR GROUPS = {'office_net'};
Defensive patterns

Strategy: try-catch

Validate before calling

// before executing
boolean isSuper = session.execute("LIST ROLES").all().stream()
    .filter(r -> r.getString("role").equals(currentUser))
    .anyMatch(AuthenticatedUser::isSuper); // or check via RoleResource
if (!isSuper && cql.contains("CIDR GROUPS")) throw new IllegalStateException("superuser required for CIDR changes");

Try / catch

try { session.execute(alterCql); }
catch (com.datastax.driver.core.exceptions.UnauthorizedException e) {
    if (e.getMessage().contains("CIDR groups")) { /* escalate to superuser session and retry */ }
}

Prevention

When it happens

Trigger: Executing ALTER ROLE ... WITH CIDR GROUPS ... (cidrPermissions != null) while logged in as a role whose isSuper() is false, even if that role has ALTER permission on the target role resource.

Common situations: A security admin role without superuser status tries to tighten or widen CIDR network restrictions for a role; role hierarchy assumptions (admin role assumed to be super) after migration from older Cassandra versions where CIDR permissions did not exist.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/081e1719143eb680. Report an issue: GitHub.