Hazelcast IMap flaw lets low-privilege clients run code on clusters
A missing authorization check in Hazelcast’s IMap Predicates API allows arbitrary code execution. Patches are available for affected versions.
Key points
- CVE-2026-107725 carries a CVSS score of 8.7, rated high.
- The vulnerability affects Hazelcast versions prior to 5.4.5, 5.5.10, and 5.6.1.
- No workarounds exist; users must upgrade to patched versions.
Hazelcast has released patches for a high-severity vulnerability that allows attackers to execute arbitrary code on cluster members. The flaw, tracked as CVE-2026-107725, stems from missing authorization checks in the IMap Predicates API. According to the National Vulnerability Database, a malicious client with limited privileges can exploit this gap to run code on the server.
What is the technical root cause?
The issue lies within the Predicates API, a component used for querying data in Hazelcast, a unified real-time data platform that combines stream processing with a fast data store. The National Vulnerability Database classifies the weakness as CWE-862, indicating a failure to restrict actions within an authorization boundary. Because the API did not properly verify permissions, it permitted clients with restricted access rights to trigger operations that resulted in arbitrary code execution on the Hazelcast member node.
Which versions are affected?
The vulnerability impacts several branches of the Hazelcast software. According to the GitHub advisory, versions of the Maven package `com.hazelcast:hazelcast` are vulnerable if they are older than 5.4.5, between 5.5.0 and 5.5.10, or between 5.6.0 and 5.6.1. The National Vulnerability Database confirms that releases prior to 5.4.5, 5.5.10, and 5.6.1 are susceptible. Users running these specific ranges are at risk until they apply the relevant updates.
What are the remediation steps?
Hazelcast has provided fixed versions for both Enterprise and Community Edition users. Enterprise customers should upgrade to version 5.7.0, 5.6.1, 5.5.10, or 5.4.5, depending on their current branch. Customers with extended support contracts for older versions are advised to contact Hazelcast Support for patch information. Community Edition users must upgrade to version 5.7.0. The GitHub advisory explicitly states that no workarounds are available. Users are urged to upgrade to a fixed version as soon as possible to mitigate the risk.
Why is this considered high severity?
The Common Vulnerability Scoring System (CVSS) rate for CVE-2026-107725 is 8.7, which falls into the high severity category. This rating reflects the significant impact of arbitrary code execution on the integrity and availability of the cluster. Since the exploit can be triggered by a client with limited privileges, the attack surface is broader than vulnerabilities requiring administrative access. The absence of workarounds further elevates the urgency for organizations to apply patches immediately.
Background: National Vulnerability Database
The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.
Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes
What to do and how to stay safe: Hazelcast
- Audit your inventory to identify any instances of Hazelcast running vulnerable versions (prior to 5.4.5, 5.5.10, or 5.6.1).
- Prioritize upgrading to the patched versions (5.4.5, 5.5.10, 5.6.1, or 5.7.0) as soon as possible since no workarounds exist.
- Review network access controls to ensure that only trusted clients can connect to Hazelcast cluster members.
- Monitor logs for unusual predicate queries or unexpected code execution attempts from clients with limited privileges.
Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits
General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a temporary workaround for CVE-2026-107725?
No, the vendor states that no workarounds are available and advises users to upgrade to a fixed version immediately.
Which specific Hazelcast versions are patched?
Enterprise users should upgrade to 5.7.0, 5.6.1, 5.5.10, or 5.4.5. Community Edition users should upgrade to 5.7.0.
What is the CVSS score for this vulnerability?
The CVSS score is 8.7, which is rated as high severity.
