Port 7000 – Multi-Use Port (AFS, Cassandra, AirPlay)

Port 7000 has no single standard service — depending on the host, it is used by the AFS (Andrew File System) distributed filesystem, by Apache Cassandra for inter-node cluster communication, or, on a Mac, by Apple’s AirPlay Receiver / Control Center. IANA registers 7000 as afs3-fileserver, and the wider AFS suite claims 7001–7009, but in modern networks you are just as likely to find a Cassandra node gossiping to its peers or a laptop advertising AirPlay. Because so many unrelated things bind here, the first job on an open port 7000 isn’t to attack a known protocol — it’s to identify what is actually answering and then assess that specific service. An exposed Cassandra internode port is a real finding (cluster and data access); a legacy AFS fileserver is a weak-auth surface worth checking; a Mac quietly running AirPlay on 7000 is usually benign.

Why It’s Open

Port 7000 is a default that several unrelated systems reach for:

• AFS (Andrew File System). The AFS fileserver process historically listens on 7000, with the rest of the suite spread across 7001–7009 (callback, ptserver, vlserver, kaserver, volserver, bosserver, and so on). AFS is a distributed network filesystem born at Carnegie Mellon and still run in some academic, research, and enterprise “cells.” Its Rx transport is UDP-based, so AFS often shows on a UDP scan even when a TCP probe looks quiet.
• Apache Cassandra. Cassandra uses 7000 for inter-node (gossip and streaming) communication between members of a cluster, and 7001 for the TLS-encrypted version of the same channel. This is separate from the client-facing CQL port (9042) and the JMX management port (7199). An internode port reachable from outside the cluster is a security-relevant exposure, not a normal service to publish.
• macOS AirPlay / Control Center. On modern macOS the AirPlay Receiver and Control Center listen on TCP 7000 (alongside 5000). This is the most common benign reason a Mac shows 7000 open.
• Dev servers and assorted apps. Some development frameworks, IoT/router services (a number of Vodafone-branded routers, for example), and custom internal apps default to 7000 as well.

On a laptop, AFS or a Cassandra node bound to a private interface is unreachable from outside — but the same software on a cloud VM, a container, or a misconfigured security group often ends up on 0.0.0.0:7000, quietly turning cluster plumbing into an internet-facing service. Port 7000 sits alongside the other multi-use catch-all, port 5000 (which also carries AirPlay), and where a dev server is answering, its neighbor port 3000 is usually one scan away.

Common Risks

• Exposed Cassandra internode port. By default the internode protocol on 7000 does not authenticate peers. If 7000 is reachable beyond the cluster’s private network, an attacker can probe the gossip protocol, map the topology, and — combined with an exposed CQL port (9042) that uses Cassandra’s default AllowAllAuthenticator — read and write every keyspace. It should never face the internet.
• Legacy AFS fileserver. AFS predates modern authentication norms. Older, unpatched OpenAFS fileservers have remotely triggerable denial-of-service and memory-disclosure bugs (see CVEs below), and a poorly secured cell can leak volume contents or accept weakly authenticated RPCs.
• Information disclosure and fingerprinting. Version banners from OpenAFS, Cassandra, or an AirPlay endpoint tell an attacker exactly what is running and which exploits apply.
• Cleartext exposure. Cassandra internode traffic on 7000 is unencrypted unless you switch to the TLS port (7001); AFS Rx and many custom apps on 7000 are likewise plaintext, so data crossing an untrusted path can be sniffed.
• AirPlay attack surface. A Mac’s AirPlay Receiver is usually harmless, but the 2025 “AirBorne” flaws showed that an AirPlay Receiver reachable on an untrusted network can be a genuine remote-code-execution path (see CVEs below).

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The whole game on port 7000 is identifying the service before you test it. Start with a version scan — including UDP, since AFS speaks Rx over UDP — then fingerprint for each likely occupant.

Detect the service and version

nmap -sV -p 7000 <target>
nmap -sU -sV -p 7000 <target>

Fingerprint an Apache Cassandra node

# 7000 = internode, 7001 = internode TLS, 9042 = CQL client, 7199 = JMX
nmap -sV -p 7000,7001,9042,7199 <target>

# If the CQL port is reachable, test for default (no-auth) access
cqlsh <target> 9042

A cluster whose internode port is exposed almost always has the CQL and JMX ports nearby; an anonymous cqlsh login means the default AllowAllAuthenticator is still in place.

Probe an AFS fileserver

# rxdebug is the canonical AFS Rx debugging tool (from the OpenAFS suite)
rxdebug <target> 7000 -version
rxdebug <target> 7000 -rxstats

# From an AFS client, enumerate the cell's servers and volumes
bos status <target> -localauth
vos listvol <target>

Identify a Mac’s AirPlay Receiver

# AirPlay advertises over mDNS; the /info endpoint returns a device plist
dns-sd -B _airplay._tcp local.      # avahi-browse -r _airplay._tcp on Linux
curl -s http://<target>:7000/info

Fall back to a raw banner grab

nc -nv <target> 7000

Log every open instance and finding you confirm so it lands in the final pentest report instead of a scratch file.

What to Look For

Known CVEs and Exploits

There is no single “port 7000” CVE — the flaws that matter belong to whatever is listening. An exposed Cassandra internode port is a configuration exposure (no peer authentication by default) rather than a named CVE and should be fixed as such; AFS and AirPlay have real product CVEs.

• CVE-2018-16949 — OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC input variables were unbounded array types, so an unauthenticated attacker can send (or claim to send) huge inputs and exhaust the fileserver, denying service to valid clients. CVSS 7.5.
• CVE-2019-18603 — OpenAFS before 1.6.24 and 1.8.x before 1.8.5. On certain error conditions, uninitialized RPC output variables are encoded and sent to the peer, leaking stack and heap memory (and, via the cache manager’s AFSCB service, kernel memory). CVSS 5.9.
• CVE-2007-6599 — Older AFS example: a race condition in the OpenAFS fileserver (1.4.x / 1.5.x) lets a remote attacker crash the daemon. CVSS 4.3 — a reminder that unpatched AFS fileservers on 7000 are remotely disruptable.
• CVE-2021-44521 — Apache Cassandra 3.0.x / 3.11.x / 4.0.x running the non-default combination enable_user_defined_functions: true, enable_scripted_user_defined_functions: true, enable_user_defined_functions_threads: false. An authenticated user with permission to create UDFs abuses the Nashorn JavaScript engine to escape the sandbox and run arbitrary code on the host. CVSS 9.1. Reached over the CQL interface (9042), not the internode port — but it’s why unauthorized access into a Cassandra cluster is a full compromise.
• CVE-2020-13946 — Apache Cassandra JMX/RMI: an attacker can manipulate the RMI registry to man-in-the-middle and capture the credentials used for JMX, then gain JMX access. CVSS 5.9. This targets the JMX port (7199), not internode 7000, but rounds out the “lock down every Cassandra port” picture.
• CVE-2025-24252 — Apple AirPlay (“AirBorne”) use-after-free; an attacker on the local network corrupts process memory. Chained with CVE-2025-24206 it becomes zero-click RCE on a Mac whose AirPlay Receiver accepts “Anyone on the same network.” Fixed in macOS 15.4 / 14.7.5 / 13.7.5. CVSS 8.8.
• CVE-2025-24132 — Stack-based buffer overflow in Apple’s AirPlay audio SDK (before 2.7.1), enabling zero-click code execution on third-party AirPlay speakers and receivers.

The previous version of this page cited CVE-2023-34721, CVE-2022-25841, CVE-2021-31918, and CVE-2020-14155 as “port 7000” bugs. None relate to AFS, Cassandra, or AirPlay — respectively they are not present in NVD, an Intel Android-app privilege escalation, a Red Hat OpenStack (tripleo-ansible) log-permission flaw, and a libpcre integer overflow. All four have been removed.

Mitigation

• Identify what runs on 7000 first. You can’t secure the port generically — fingerprint the service (AFS, Cassandra, AirPlay, or a custom app) and harden that specific thing.
• Never expose Cassandra’s internode port. Bind listen_address to the cluster’s private interface, and firewall 7000 (and 7001, 9042, 7199) so only cluster members and trusted clients can reach them. Turn on internode encryption (7001/TLS) and replace AllowAllAuthenticator with real authentication and authorization; require JMX authentication. A Cassandra port should never be internet-facing.
• Patch and segment AFS. Run a current OpenAFS (≥ 1.8.5 / 1.6.24), keep the AFS cell on trusted networks behind a firewall covering 7000–7009, and use proper Kerberos-backed AFS authentication rather than legacy weak auth.
• Keep AirPlay off untrusted networks and patched. Update macOS/iOS to a fixed release, set the AirPlay Receiver to “Current User” or disable it, and firewall 5000/7000 to trusted devices.
• Firewall port 7000 to trusted ranges, and audit cloud security groups and container port mappings for an accidental 0.0.0.0:7000. If nothing needs the port, stop the service and confirm it’s closed with a rescan.

Real-World Example

The signature port-7000 finding for a pentester is an internet-reachable Apache Cassandra cluster. Cassandra’s internode gossip on 7000 authenticates nothing by default, and historically clusters shipped with AllowAllAuthenticator on the CQL side and were bound to 0.0.0.0 in a hurry during setup. A cloud VM with a too-broad security group, or a container that published -p 7000:7000 and -p 9042:9042, is enough to expose the whole thing: an attacker finds 7000 open, sees the neighboring CQL and JMX ports, connects with cqlsh and no credentials, and reads or rewrites every keyspace. If the operators also enabled scripted user-defined functions in the non-default configuration behind CVE-2021-44521, that database foothold becomes arbitrary code execution on the node. It’s the clearest illustration of the port-7000 lesson: the port is mundane, but the cluster listening on it is the real attack surface — and it was never meant to be reachable from outside the data center.

FAQ

What is port 7000 used for?

Port 7000 has no single standard service. IANA registers it as afs3-fileserver for the AFS (Andrew File System) distributed filesystem, Apache Cassandra uses it for inter-node cluster communication, and modern macOS uses it for the AirPlay Receiver / Control Center. On an open 7000, the first step is to identify which of these is actually running.

Why is port 7000 open on my Mac?

Modern macOS runs the AirPlay Receiver and Control Center on ports 7000 and 5000. That’s the usual, benign reason a Mac shows 7000 listening. If you don’t AirPlay to your Mac, you can turn the AirPlay Receiver off in System Settings, which frees the port.

Is port 7000 the Cassandra port?

It’s one of them. Cassandra uses 7000 for internode (gossip/streaming) traffic and 7001 for its TLS-encrypted version. The port applications connect to is 9042 (CQL), and JMX management is 7199. Port 7000 is meant only for communication between cluster nodes and should never be exposed outside the cluster’s private network.

How do I check what’s running on port 7000?

Fingerprint it: nmap -sV -p 7000 <host> (add -sU because AFS uses UDP). Apache Cassandra shows up alongside 9042/7199; an AFS fileserver answers the rxdebug <host> 7000 probe; an _airplay._tcp mDNS record plus an /info plist on 7000 means a Mac’s AirPlay Receiver.

Is port 7000 safe to leave open?

The port itself is harmless; the risk depends on what’s behind it. A Cassandra internode port or an unpatched AFS fileserver exposed to the internet is a real problem — cluster/data compromise or remote DoS. A Mac’s AirPlay on a trusted, patched network is usually fine. Don’t publish 7000 to untrusted networks.

Is port 7000 TCP or UDP?

Both, depending on the service. Cassandra internode and AirPlay use TCP; AFS’s Rx transport is UDP-based, so an AFS fileserver often only shows up on a UDP scan. A thorough check scans both.

TL;DR

• Service: no single standard — the AFS distributed filesystem (afs3-fileserver), Apache Cassandra inter-node clustering, or (on a Mac) AirPlay/Control Center
• Default port: 7000/TCP for Cassandra internode and AirPlay; AFS uses 7000 over UDP (Rx), with 7001–7009 for the rest of the AFS suite
• Biggest risk: an exposed Cassandra internode port (no peer auth by default → cluster and data access) and unpatched OpenAFS fileserver DoS/memory-disclosure bugs
• Mitigation: identify the service, keep Cassandra (7000/7001/9042/7199) and AFS off the internet, patch OpenAFS and AirPlay, and firewall port 7000 to trusted hosts