Hazelcast: Missing authorization in IMap Predicates API allows code execution
Summary
Hazelcast, a real-time data platform, has a missing authorization check in its IMap Predicates API. An authenticated client with limited privileges can execute arbitrary code on a Hazelcast cluster member, which the vendor rates as High severity (CVSS 4.0 8.7). Exploitation requires valid client credentials and network access to the cluster.
Affected
- Hazelcast versions before 5.4.5
- Hazelcast 5.5.0 to before 5.5.10
- Hazelcast 5.6.0 to before 5.6.1
- Note: the GitLab advisory database lists all versions before 5.7.0 as affected. The vendor ranges above are authoritative.
Fixed in
- 5.4.5
- 5.5.10
- 5.6.1
- 5.7.0
- Enterprise customers on extended support contracts should contact Hazelcast Support for patches for older branches.
Workaround
No vendor-published workaround. Until patched, restrict which clients can connect to the cluster and limit client permissions and network reach to the member ports.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept or known in-the-wild exploitation found in the sources reviewed. The CISA KEV catalogue was not checked directly.
- EPSS 0.00385 (as reported by Vulners).
Our recommendation
- Check whether Hazelcast is used, for example in custom or third-party Java applications, and which version runs.
- Upgrade to a fixed version for your branch as soon as possible.
- Verify that cluster and client ports are not reachable from the internet and review client credentials.
- Treat the upgrade as urgent if clients are external or credentials are shared.
- Monitor logs for unusual client activity on cluster members.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-w294-6q5q-53p8 github.com
- Hazelcast Community Edition Release Notes 5.7 docs.hazelcast.com
- Hazelcast Enterprise Edition Release Notes 5.7 docs.hazelcast.com
- Fix commit 5d68f4828e2a914398a39f12fe11cafd335cefe0 github.com
- OSV CVE-2026-107725 osv.dev
- OSV GHSA-w294-6q5q-53p8 osv.dev
- GitLab Advisory Database CVE-2026-107725 advisories.gitlab.com
- Tenable CVE-2026-107725 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:13.
Original description (NVD)
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.