apache/cassandra · error · UnauthorizedException

Only superusers are allowed to alter access from CIDR…

Error message

Only superusers are allowed to alter access from CIDR groups.

What it means

Cassandra throws this UnauthorizedException when a non-superuser role attempts ALTER ROLE while specifying CIDR-group access (cidrPermissions). Only superusers may grant or revoke access from CIDR groups, as enforced in AlterRoleStatement.authorize.

Solutions

  1. Log in as (or grant superuser to, via an existing superuser) a superuser role before altering CIDR group access
  2. Split the statement: perform non-CIDR attribute changes with the current role and delegate only CIDR changes to a superuser
  3. Enable and configure CIDR authorization in cassandra.yaml and verify the executing role's superuser status with LIST ROLES

Example fix

// before
ALTER ROLE service_role WITH CIDR GROUPS = {'office_net'};
// after
-- run as superuser, e.g. cassandra or another super role
ALTER ROLE service_role WITH CIDR GROUPS = {'office_net'};
Defensive patterns

Strategy: try-catch

Validate before calling

// before executing
boolean isSuper = session.execute("LIST ROLES").all().stream()
    .filter(r -> r.getString("role").equals(currentUser))
    .anyMatch(AuthenticatedUser::isSuper); // or check via RoleResource
if (!isSuper && cql.contains("CIDR GROUPS")) throw new IllegalStateException("superuser required for CIDR changes");

Try / catch

try { session.execute(alterCql); }
catch (com.datastax.driver.core.exceptions.UnauthorizedException e) {
    if (e.getMessage().contains("CIDR groups")) { /* escalate to superuser session and retry */ }
}

Prevention

When it happens

Trigger: Executing ALTER ROLE ... WITH CIDR GROUPS ... (cidrPermissions != null) while logged in as a role whose isSuper() is false, even if that role has ALTER permission on the target role resource.

Common situations: A security admin role without superuser status tries to tighten or widen CIDR network restrictions for a role; role hierarchy assumptions (admin role assumed to be super) after migration from older Cassandra versions where CIDR permissions did not exist.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/081e1719143eb680. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java:113

    }

    public void authorize(ClientState state) throws UnauthorizedException
    {
        AuthenticatedUser user = state.getUser();
        boolean isSuper = user.isSuper();

        if (opts.getSuperuser().isPresent() && user.getRoles().contains(role))
            throw new UnauthorizedException("You aren't allowed to alter your own superuser " +
                                            "status or that of a role granted to you");

        if (opts.getSuperuser().isPresent() && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter superuser status");

        if (dcPermissions != null && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter access to datacenters.");

        if (cidrPermissions != null && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter access from CIDR groups.");

        // superusers can do whatever else they like
        if (isSuper)
            return;

        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions
        if (user.getName().equals(role.getRoleName()))
        {
            for (Option option : opts.getOptions().keySet())
            {
                if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option))
                    throw new UnauthorizedException(String.format("You aren't allowed to alter %s", option));
            }
        }
        else
        {
            // if not attempting to alter another role, ensure we have ALTER permissions on it
            super.checkPermission(state, Permission.ALTER, role);

View on GitHub (pinned to 88fd0f6a0e)