apache/cassandra · critical · SecurityException

The arbitrary command execution is not permitted with %s MBe

Error message

The arbitrary command execution is not permitted with %s MBean. If unsafe command execution is required, start Cassandra with %s property set to true. Rejected command: %s

What it means

AsyncProfilerService.execute refuses to forward arbitrary async-profiler commands to the native agent unless the operator explicitly enabled unsafe mode via the CassandraRelevantProperties.ASYNC_PROFILER_UNSAFE_MODE system property. This is a deliberate security guard against arbitrary command execution through the JMX MBean. The exception names the MBean, the required property, and the rejected command.

Source

Thrown at src/java/org/apache/cassandra/service/AsyncProfilerService.java:310

            return true;
        }
        catch (IllegalStateException | IllegalArgumentException e)
        {
            throw e;
        }
        catch (Throwable e)
        {
            logger.error("Failed to stop Async-Profiler", e);
            return false;
        }
    }

    @Override
    public String execute(String command)
    {
        if (!unsafeMode)
        {
            throw new SecurityException(String.format("The arbitrary command execution is not permitted " +
                                                      "with %s MBean. If unsafe command execution is required, " +
                                                      "start Cassandra with %s property set to true. " +
                                                      "Rejected command: %s",
                                                      AsyncProfilerService.MBEAN_NAME,
                                                      CassandraRelevantProperties.ASYNC_PROFILER_UNSAFE_MODE.getKey(), command));
        }

        return run(new ThrowingFunction<>()
        {
            @Override
            public String apply(AsyncProfiler profiler) throws Throwable
            {
                return profiler.execute(validateCommand(command));
            }
        });
    }

    @Override

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Restart Cassandra with -Dcassandra.async_profiler.unsafe.mode=true if arbitrary commands are genuinely required and the environment is trusted
2. Use the safer structured MBean operations (start/stop/cmd/fetch) instead of raw execute()
3. Confirm JMX access is restricted (authentication, firewall) before enabling unsafe mode

Example fix

// before
cassandra -Dcassandra.async_profiler.unsafe.mode=false
// after (only on trusted nodes)
cassandra -Dcassandra.async_profiler.unsafe.mode=true

boolean unsafeOk = Boolean.parseBoolean(System.getProperty("cassandra.async_profiler.unsafe.mode", "false"));
if (!unsafeOk) throw new IllegalStateException("execute() requires -Dcassandra.async_profiler.unsafe.mode=true");

try { return svc.execute(cmd); } catch (SecurityException e) { log.warn("execute blocked: {}", e.getMessage()); return svc.start(Map.of()); }

When it happens

Trigger: Invoking the execute(String) MBean operation (directly or via tooling like testAdvancedModeEnabledSuccess) while the cassandra.async_profiler.unsafe.mode property is not set to true.

Common situations: Automation scripts calling execute() for advanced profiling modes; security-hardened production nodes where unsafe mode is intentionally off; operators unaware this MBean is gated by a startup property.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Access denied
• Access Denied
• Access is denied!
• Illegal file to fetch:
• Can't enable audit log archiving via nodetool unless audit_l

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/531acf770db5b109. Report an issue: GitHub.