Critical RCE in Hazelcast IMap Predicates API Affects Versions Before 5.4.5, 5.5.10, and 5.6.1
Missing authorization checks in the Hazelcast IMap Predicates API allow limited-privilege clients to execute arbitrary code on cluster members.
Key points
- CVE-2026-107725 is rated High severity with a CVSS score of 8.7.
- The vulnerability stems from missing authorization checks in the IMap Predicates API.
- Patches are available for Enterprise and Community Edition users in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Hazelcast has released patches for a high-severity remote code execution vulnerability in its unified real-time data platform. The flaw, tracked as CVE-2026-107725, allows malicious clients with limited privileges to execute arbitrary code on a Hazelcast cluster member due to missing authorization checks in the IMap Predicates API.
At a glance
- CVE
- CVE-2026-107725
- Product
- hazelcast
- CVSS
- 8.7 High
- Weakness
- missing authorization
- Exploited
- No known exploitation
The vulnerability affects versions prior to 5.4.5, 5.5.10, and 5.6.1. According to the National Vulnerability Database, the issue carries a CVSS score of 8.7, classifying it as High severity. The weakness is categorized under CWE-862, which relates to improper access control. Without proper authorization verification, an attacker can leverage the Predicates API to run unauthorized commands on the server side, potentially compromising the entire cluster.
Context and Background
Hazelcast describes its platform as a combination of stream processing and a fast data store. The Predicates API is a component used for querying data within this environment. The security advisory notes that the lack of authorization checks in this specific API endpoint creates a direct path for code execution.
GitHub advisory GHSA-w294-6q5q-53p8 confirms the impact, stating that a malicious client may execute arbitrary code on a Hazelcast member. The advisory emphasizes that there are no workarounds for this issue. Customers are advised to upgrade to a fixed version as soon as possible to mitigate the risk.
Who Is Affected
The vulnerability impacts multiple version lines of the Hazelcast software. Specifically, the affected ranges include versions less than 5.4.5, versions greater than or equal to 5.5.0 but less than 5.5.10, and versions greater than or equal to 5.6.0 but less than 5.6.1.
Enterprise customers are instructed to upgrade to one of the following fixed versions: 5.7.0, 5.6.1, 5.5.10, or 5.4.5. Community Edition users should upgrade to version 5.7.0. For those with extended support contracts on older versions, Hazelcast advises contacting their support team for information on available patches.
What should you do?
Organizations using Hazelcast should immediately inventory their deployments to identify if they are running vulnerable versions. If a system is found to be within the affected version ranges, administrators should prioritize upgrading to the latest patched release. Since no workarounds exist, delaying the patch leaves the cluster exposed to potential remote code execution.
What to do and how to stay safe: Hazelcast
- Audit your infrastructure to identify all instances of Hazelcast and verify their current version numbers against the affected ranges.
- If you are running an affected version, schedule an immediate upgrade to the latest patched release (5.4.5, 5.5.10, 5.6.1, or 5.7.0) as soon as possible.
- Monitor cluster logs and network traffic for unusual activity or unauthorized code execution attempts while planning the upgrade.
- Contact Hazelcast Support if you are on an older version covered by an extended support contract to obtain specific patching guidance.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107725?
It is a high-severity vulnerability in Hazelcast that allows arbitrary code execution due to missing authorization checks in the IMap Predicates API.
Which versions of Hazelcast are affected?
Versions prior to 5.4.5, 5.5.10, and 5.6.1 are affected. This includes versions < 5.4.5, >= 5.5.0 and < 5.5.10, and >= 5.6.0 and < 5.6.1.
Is there a workaround for this vulnerability?
No, there are no workarounds. Users are advised to upgrade to a fixed version immediately.
