CASSANDRA-11848the local node could be considered a source, while now sources are restricted only to dc2, so since system_auth uses SimpleStrategy depending on the token arrangement there could or not be sources from dc2. Fix is to either use -Dcassandra.consistent.rangemovement=false or update system_auth to use NetworkTopologyStrategy with 2 dcs..
This is, at the very least, a UX bug. When rebuild fails, it fails with
which suggests that a user should give up consistency guarantees when it's not necessary.