Hazelcast vulnerabilities
We track 6 vulnerabilities in Hazelcast products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Hazelcast vulnerabilities
- 9.3 Critical severity
Hazelcast is a unified real-time data platform combining stream processing with a fast data…
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster
- 8.7 High severity
hazelcast: Missing Authorization
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary
- 9.8 Critical severity
Management Center: Improper Control of Generation of Code
Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client configuration file), which can be uploaded at the /cluster-connections URI.
- 7.6 High severity
Hazelcast: Insecure Storage of Sensitive Information
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
- 8.8 High severity
Hazelcast: Missing Authorization
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
- 9.1 Critical severity
Hazelcast: Session Fixation
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9,