CVE-2023-45859: Missing permission checks on Hazelcast client protocol
Summary
CVE-2023-45859: Missing permission checks on Hazelcast client protocol. Affects com.hazelcast:hazelcast across 6 version ranges.
< 4.1.10
>= 4.2, <= 4.2.8
>= 5.0, <= 5.0.5
>= 5.1, <= 5.1.7
>= 5.2.0, < 5.2.5
>= 5.3.0, < 5.3.5
Fixed in 4.1.10, 5.2.5 or 5.3.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Hazelcast is an open-source in-memory data grid that provides distributed data storage and caching capabilities. It allows applications to scale horizontally by distributing data across multiple nodes in a cluster. The Hazelcast client protocol is used to communicate with the Hazelcast cluster from client applications. This vulnerability affects versions 4.1.10 to 4.2.8, 5.0 to 5.0.5, 5.1 to 5.1.7, 5.2 to 5.2.4, and 5.3 to 5.3.2 of the Hazelcast package.
Vulnerability Detail
The vulnerability in Hazelcast allows authenticated users to access data stored in the cluster without proper permission checks. Certain client operations do not enforce permission checks, potentially exposing sensitive information to unauthorized users. This can lead to unauthorized data access and potential data breaches.
How To Fix
Latest published version: 5.7.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10 -
>= 5.2.0, < 5.2.55.2.5 -
>= 5.3.0, < 5.3.55.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions mentioned above to mitigate the risk of unauthorized data access.
Conclusion
The vulnerability in Hazelcast allows authenticated users to access data stored in the cluster without proper permission checks. It is crucial to update to the fixed versions (5.2.5, 5.3.5, or 5.4.0-BETA-1) to mitigate the risk of unauthorized data access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.hazelcast:hazelcast →
FAQ
Hazelcast is an open-source in-memory data grid that provides distributed data storage and caching capabilities. It allows applications to scale horizontally by distributing data across multiple nodes in a cluster.
The vulnerability allows authenticated users to access data stored in the Hazelcast cluster without proper permission checks. This can lead to unauthorized data access and potential data breaches.
Versions 4.1.10 to 4.2.8, 5.0 to 5.0.5, 5.1 to 5.1.7, 5.2 to 5.2.4, and 5.3 to 5.3.2 of the Hazelcast package are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed versions mentioned above.
To fix this vulnerability, update the Hazelcast package to version 5.2.5, 5.3.5, or 5.4.0-BETA-1.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.hazelcast:hazelcast.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
