Port reference
Port 9042 (TCP) – Apache Cassandra CQL
Default port for the Cassandra CQL native binary protocol used by clients and drivers.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Cassandra ships with the PasswordAuthenticator disabled and a default cassandra/cassandra superuser. Many instances listen on 0.0.0.0:9042 with no authentication, exposing all keyspaces.
What is port 9042 used for?
Port 9042 is the default for the Apache Cassandra CQL native protocol, the connection your applications and client drivers use to run CQL queries against a Cassandra cluster. Official drivers for Java, Python, Node.js, and Go all connect here, as do tools like the cqlsh shell and DataStax clients. Systems built on Cassandra, such as ScyllaDB, also use it. Cassandra's own node-to-node traffic uses 7000 and JMX management uses 7199.
When would you open it?
Open or forward 9042 when your application servers need to reach a Cassandra cluster that runs on different hosts. In practice you restrict it to the specific app or backend machines that query the database rather than opening it widely. If everything runs on one host, it can stay on localhost.
Is it safe to open?
Cassandra ships with authentication off and a default cassandra/cassandra superuser, so an exposed port lets anyone read or delete your data. Turn on authentication, change the default account, and limit the port to trusted hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :9042
nmap -p 9042 <target>netstat -ano | findstr :9042
Test-NetConnection <host> -Port 9042lsof -i :9042
nmap -p 9042 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 9042 to your device's local IP, internal port 9042, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 9042/tcpsudo firewall-cmd --permanent --add-port=9042/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9042 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 9042" -Direction Inbound -Protocol TCP -LocalPort 9042 -Action AllowSecurity & risks
Common attacks
- Login with the default cassandra/cassandra superuser credentials
- Unauthenticated CQL access to read or dump all keyspaces and tables
- Data exfiltration and deletion of sensitive records
- CQL injection from exposed application layers
Hardening
- Enable PasswordAuthenticator and CassandraAuthorizer; change the default cassandra user
- Bind rpc_address to a private interface; never expose 9042 to the internet
- Require client-to-node TLS encryption
- Firewall 9042 to application hosts; restrict JMX (7199) and inter-node (7000)
- Keep Cassandra patched and audit access
How to block this port
sudo ufw deny 9042/tcpsudo firewall-cmd --permanent --remove-port=9042/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9042 -j DROPNew-NetFirewallRule -DisplayName "Block 9042" -Direction Inbound -Protocol TCP -LocalPort 9042 -Action Blocknmap snippet
nmap -p9042 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the default Cassandra login?
- Cassandra ships with a default superuser cassandra/cassandra and authentication often disabled. Always enable PasswordAuthenticator, create least-privilege roles, and replace the default account before exposing the database.
- Which Cassandra ports should never be public?
- Keep 9042 (CQL) behind a firewall, and never expose inter-node port 7000 or the JMX port 7199 to untrusted networks, since they allow node and JVM control.