{"record":{"id":"15411be0e3bbf264","repo":"apache/cassandra","slug":"invalid-metadata-has-been-detected-for-role-s","errorCode":null,"errorMessage":"Invalid metadata has been detected for role %s","messagePattern":"Invalid metadata has been detected for role (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/CassandraRoleManager.java","lineNumber":151,"sourceCode":"    // Transform a row in the AuthKeyspace.ROLES to a Role instance\n    private static final Function<UntypedResultSet.Row, Role> ROW_TO_ROLE = row ->\n    {\n        try\n        {\n            return new Role(row.getString(\"role\"),\n                            row.getBoolean(\"is_superuser\"),\n                            row.getBoolean(\"can_login\"),\n                            Collections.emptyMap(),\n                            row.has(\"member_of\") ? row.getSet(\"member_of\", UTF8Type.instance)\n                                                 : Collections.<String>emptySet());\n        }\n        // Failing to deserialize a boolean in is_superuser or can_login will throw an NPE\n        catch (NullPointerException e)\n        {\n            logger.warn(\"An invalid value has been detected in the {} table for role {}. If you are \" +\n                        \"unable to login, you may need to disable authentication and confirm \" +\n                        \"that values in that table are accurate\", AuthKeyspace.ROLES, row.getString(\"role\"));\n            throw new RuntimeException(String.format(\"Invalid metadata has been detected for role %s\", row.getString(\"role\")), e);\n        }\n    };\n\n    private static int PASSWORD_UPDATE_MIN_INTERVAL_MS = CassandraRelevantProperties.ROLE_PASSWORD_UPDATE_MIN_INTERVAL_MS.getInt();\n    // in-memory protection against excessive loadRoleWithWritetimeStatement queries\n    private static Cache<String, Boolean> recentPasswordUpdates = Caffeine.newBuilder()\n                                        .expireAfterWrite(PASSWORD_UPDATE_MIN_INTERVAL_MS, TimeUnit.MILLISECONDS)\n                                        .build();\n\n    @VisibleForTesting\n    public static synchronized void updatePasswordUpdateMinInterval(int newInterval)\n    {\n        recentPasswordUpdates = Caffeine.newBuilder().expireAfterWrite(newInterval, TimeUnit.MILLISECONDS).build();\n        PASSWORD_UPDATE_MIN_INTERVAL_MS = newInterval;\n    }\n\n    private SelectStatement loadRoleStatement;\n    private SelectStatement loadIdentityStatement;","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L133-L169","documentation":"CassandraRoleManager wraps the NullPointerException thrown when a role row's is_superuser or can_login boolean fails to deserialize into a RuntimeException 'Invalid metadata has been detected for role %s'. It indicates corrupted or invalidly-written data in the system_auth.roles table.","triggerScenarios":"loadRole from system_auth.roles where the is_superuser or can_login column value cannot be deserialized as a boolean (null/garbage bytes in the cell).","commonSituations":"Manual edits to system_auth, partial or failed upgrades/migrations, restoring auth tables from inconsistent snapshots, or rows written by a different schema version.","solutions":["Enable the described mitigation: temporarily set authenticator to AllowAllAuthenticator so you can log in.","Inspect the row: SELECT role, can_login, is_superuser FROM system_auth.roles WHERE role = '<role>';","Repair the row with correct boolean values: UPDATE system_auth.roles SET can_login = true, is_superuser = false WHERE role = '<role>';","If system_auth is broadly corrupt, restore it from a consistent backup or recreate roles."],"exampleFix":"// cqlsh repair of the corrupted role row\nUPDATE system_auth.roles SET can_login = true, is_superuser = false WHERE role = 'bob';","handlingStrategy":"validation","validationCode":"-- detect corrupt role rows before they break login\nSELECT role, can_login, is_superuser FROM system_auth.roles;\n-- any NULL in can_login/is_superuser is a problem row","typeGuard":null,"tryCatchPattern":"try {\n    roleManager.getRole(roleName);\n} catch (RuntimeException e) {\n    if (e.getMessage().startsWith(\"Invalid metadata has been detected\")) {\n        repairRoleRow(roleName); // UPDATE can_login/is_superuser\n    }\n}","preventionTips":["Never hand-edit system_auth tables with wrong-typed values.","Snapshot all keyspaces (including system_auth) consistently when backing up.","Verify role rows after auth-related upgrades or migrations."],"tags":["auth","roles","data-corruption","cassandra"],"backgroundTag":"schema-validation-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}