What causes "cassandra query failed: %s" in shadow1ng/fscan?

Inspect the embedded server message to learn why the query failed (permissions, unavailable, syntax).

cassandra query failed: %s

Error message

cassandra query failed: %s

What it means

validateCQLQueryResponse checks the reply to the test query (SELECT cluster_name FROM system.local); if the server answered with an ERROR opcode, the raw server error is surfaced as 'cassandra query failed: %s'. Auth succeeded but the query itself failed.

Source

Thrown at plugins/services/cassandra.go:217

	}
	opcode := header[4]
	bodyLen := int(binary.BigEndian.Uint32(header[5:9]))
	if bodyLen == 0 {
		return opcode, []byte{}, nil
	}
	if bodyLen > maxCQLFrameBody {
		return opcode, nil, fmt.Errorf("cassandra frame too large: %d", bodyLen)
	}
	body := make([]byte, bodyLen)
	if _, err := io.ReadFull(conn, body); err != nil {
		return opcode, nil, err
	}
	return opcode, body, nil
}

func validateCQLQueryResponse(opcode byte, body []byte) error {
	if opcode == cqlOpError {
		return fmt.Errorf("cassandra query failed: %s", string(body))
	}
	if opcode != cqlOpResult {
		return fmt.Errorf("unexpected query opcode: %d", opcode)
	}
	return nil
}

// cqlStringMap CQL string map 编码: [2B count] [pairs: [2B len] [str]]
func cqlStringMap(m map[string]string) []byte {
	var buf []byte
	buf = append(buf, 0x00, byte(len(m))) // count as short
	for k, v := range m {
		buf = append(buf, cqlShortString(k)...)
		buf = append(buf, cqlShortString(v)...)
	}
	return buf
}

View on GitHub (pinned to 95cc12e753)

Solutions

Inspect the embedded server message to learn why the query failed (permissions, unavailable, syntax).
Grant the test user SELECT on system.local, or test with a higher-privileged account.
Retry against another node if the error indicates the node is unavailable or overloaded.

Defensive patterns

Strategy: try-catch

Try / catch

if err := validateCQLQueryResponse(opcode, body); err != nil {
    var srv string
    fmt.Sscanf(err.Error(), "cassandra query failed: %s", &srv)
    log.Printf("test query rejected: %s", srv)
}

Prevention

Ensure the test account has SELECT permission on system.local.
Use a simple, version-stable validation query.
Check node health (nodetool status) if query failures cluster on one node.

When it happens

Trigger: doCassandraAuth or tryNoAuthConnection completes authentication, sends the test query via cqlSend, reads the response with cqlRecv, and passes it to validateCQLQueryResponse which sees opcode == cqlOpError.

Common situations: Authenticated user lacks SELECT permission on system.local; keyspace/system table unavailable; query syntax rejected due to protocol-version quirks; node unhealthy during validation.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/b71eacfd8339857f. Report an issue: GitHub.