{"record":{"id":"531acf770db5b109","repo":"apache/cassandra","slug":"the-arbitrary-command-execution-is-not-permitted-w","errorCode":null,"errorMessage":"The arbitrary command execution is not permitted with %s MBean. If unsafe command execution is required, start Cassandra with %s property set to true. Rejected command: %s","messagePattern":"The arbitrary command execution is not permitted with (.+?) MBean\\. If unsafe command execution is required, start Cassandra with (.+?) property set to true\\. Rejected command: (.+?)","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"critical","filePath":"src/java/org/apache/cassandra/service/AsyncProfilerService.java","lineNumber":310,"sourceCode":"            return true;\n        }\n        catch (IllegalStateException | IllegalArgumentException e)\n        {\n            throw e;\n        }\n        catch (Throwable e)\n        {\n            logger.error(\"Failed to stop Async-Profiler\", e);\n            return false;\n        }\n    }\n\n    @Override\n    public String execute(String command)\n    {\n        if (!unsafeMode)\n        {\n            throw new SecurityException(String.format(\"The arbitrary command execution is not permitted \" +\n                                                      \"with %s MBean. If unsafe command execution is required, \" +\n                                                      \"start Cassandra with %s property set to true. \" +\n                                                      \"Rejected command: %s\",\n                                                      AsyncProfilerService.MBEAN_NAME,\n                                                      CassandraRelevantProperties.ASYNC_PROFILER_UNSAFE_MODE.getKey(), command));\n        }\n\n        return run(new ThrowingFunction<>()\n        {\n            @Override\n            public String apply(AsyncProfiler profiler) throws Throwable\n            {\n                return profiler.execute(validateCommand(command));\n            }\n        });\n    }\n\n    @Override","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/AsyncProfilerService.java#L292-L328","documentation":"AsyncProfilerService.execute refuses to forward arbitrary async-profiler commands to the native agent unless the operator explicitly enabled unsafe mode via the CassandraRelevantProperties.ASYNC_PROFILER_UNSAFE_MODE system property. This is a deliberate security guard against arbitrary command execution through the JMX MBean. The exception names the MBean, the required property, and the rejected command.","triggerScenarios":"Invoking the execute(String) MBean operation (directly or via tooling like testAdvancedModeEnabledSuccess) while the cassandra.async_profiler.unsafe.mode property is not set to true.","commonSituations":"Automation scripts calling execute() for advanced profiling modes; security-hardened production nodes where unsafe mode is intentionally off; operators unaware this MBean is gated by a startup property.","solutions":["Restart Cassandra with -Dcassandra.async_profiler.unsafe.mode=true if arbitrary commands are genuinely required and the environment is trusted","Use the safer structured MBean operations (start/stop/cmd/fetch) instead of raw execute()","Confirm JMX access is restricted (authentication, firewall) before enabling unsafe mode"],"exampleFix":"// before\ncassandra -Dcassandra.async_profiler.unsafe.mode=false\n// after (only on trusted nodes)\ncassandra -Dcassandra.async_profiler.unsafe.mode=true","handlingStrategy":"validation","validationCode":"boolean unsafeOk = Boolean.parseBoolean(System.getProperty(\"cassandra.async_profiler.unsafe.mode\", \"false\"));\nif (!unsafeOk) throw new IllegalStateException(\"execute() requires -Dcassandra.async_profiler.unsafe.mode=true\");","typeGuard":null,"tryCatchPattern":"try { return svc.execute(cmd); } catch (SecurityException e) { log.warn(\"execute blocked: {}\", e.getMessage()); return svc.start(Map.of()); }","preventionTips":["Prefer start/stop/cmd/fetch over raw execute()","Enable unsafe mode only on trusted, JMX-locked-down nodes","Document the required startup property in runbooks"],"tags":["security","jmx","arbitrary-command-execution"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}