High severity · published Oct 8, 2026
CVE-2026-107725
Hazelcast: Authorization bypass in IMap Predicates API
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
hazelcast · hazelcast
< 5.4.5; >= 5.5.0, < 5.5.10; >= 5.6.0, < 5.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107725
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107725
x_refsource_CONFIRM
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8
x_refsource_MISC
https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0
x_refsource_MISC
https://docs.hazelcast.com/hazelcast/5.7/release-notes/community
x_refsource_MISC
https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise
More from hazelcast
9.8
CVE-2022-0265
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
9.8
CVE-2020-26168
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some…
9.3
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged client
9.1
CVE-2022-36437
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already…
8.8
CVE-2023-33265
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on…