Critical severity · published Nov 9, 2020
CVE-2020-26168
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some…
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hazelcast · Hazelcast
4.0 before 4.0.3 · source: NVD
JE
Jet · Hazelcast
4.0 through 4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26168
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26168
Release Notes
https://docs.hazelcast.org/docs/ern/index.html#4-0-3
Vendor Advisory
https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass
Vendor Advisory
https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass
Vendor Advisory
https://jet-start.sh/blog/2020/10/23/jet-43-is-released
More from Hazelcast
9.8
CVE-2022-0265
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
9.3
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged client
9.1
CVE-2022-36437
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already…
8.8
CVE-2023-33265
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on…
8.7
CVE-2026-107725
Hazelcast: Authorization bypass in IMap Predicates API