CVE-2026-107725

Received Received - Intake

Arbitrary Code Execution in Hazelcast IMap Predicates API

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107725

Affected Vendors & Products

Vendor	Product	Version / Range
hazelcast	hazelcast	< 5.4.5
hazelcast	hazelcast	>= 5.5.0, < 5.5.10
hazelcast	hazelcast	>= 5.6.0, < 5.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Hazelcast is a missing authorization check in the IMap Predicates API. It allows a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. The issue affects versions prior to 5.4.5, 5.5.10, and 5.6.1.

Impact Analysis

An attacker could exploit this to run unauthorized code on your Hazelcast cluster, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information stored in the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance could be compromised if sensitive data is exposed or mishandled due to the exploit.

Mitigation Strategies

Upgrade Hazelcast to a patched version (5.4.5, 5.5.10, 5.6.1, or 5.7.0) immediately to address the missing authorization checks in the IMap Predicates API.

Hi! I’m here to help you understand CVE-2026-107725. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70