Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107725Hazelcast: Authorization bypass in IMap Predicates API

High 8.7

In plain English

A high-severity missing authorization in hazelcast from hazelcast. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.hazelcast:hazelcast	5.7.0	GHSA-w294-6q5q-53p8
Maven	com.hazelcast:hazelcast	5.7.0	GHSA-w294-6q5q-53p8
Maven	com.hazelcast:hazelcast	5.7.0	GHSA-w294-6q5q-53p8

Affected products (as reported)

Vendor	Product	Versions
hazelcast	hazelcast	< 5.4.5>= 5.5.0, < 5.5.10>= 5.6.0, < 5.6.1

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8 x_refsource_CONFIRM
https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0 x_refsource_MISC
https://docs.hazelcast.com/hazelcast/5.7/release-notes/community x_refsource_MISC
https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise x_refsource_MISC