CVE-2023-33264
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In Hazelcast versions 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines do not properly mask passwords in member configuration, allowing Hazelcast Management Center users to view some secrets.
Risk Assessment
The organization may be exposed to the disclosure of sensitive information, potentially leading to unauthorized access to systems.
Recommendation
It is recommended to upgrade to the latest version of Hazelcast where the issue has been fixed, and to review and secure password configurations.
Other vulnerabilities in Hazelcast
See all- CVE-2026-107726Critical
Hazelcast prior to 5.4.5, 5.5.10, and 5.6.1 contains improper validation of data supplied by a malicious client able to connect to a cluster, allowing arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
- CVE-2026-107725High
Hazelcast is a unified real-time data platform. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member.
- CVE-2023-33265High
In Hazelcast versions 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services do not properly check client permissions, allowing authenticated users to execute tasks on members without the required permissions.
Original NVD description (English source)
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS