CVE-2026-107725: Hazelcast: Authorization bypass in IMap Predicates API

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-09
Weakness: CWE-862

Description

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.

Affected products

hazelcast: before 5.4.5; from 5.5.0, < 5.5.10; from 5.6.0, < 5.6.1

References

https://docs.hazelcast.com/hazelcast/5.7/release-notes/community
https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise
https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8

Get alerted when CVE-2026-107725 or the next vulnerability affects your stack