Skip to content
CVE IDCVE-2026-107725GitHub advisory IDGHSA-w294-6q5q-53p8

Hazelcast has an authorization bypass in IMap Predicates API

CVE-2026-107725 (GitHub advisory GHSA-w294-6q5q-53p8) is a high-severity vulnerability with a CVSS 4.0 base score of 8.7, classed as Missing Authorization (CWE-862), in com.hazelcast:hazelcast (Maven). Affected versions: = 5.6.0; >= 5.5.0, < 5.5.10; < 5.4.5. It is fixed in 5.7.0.

High8.7Fix availableGitHub reviewed

Published 8 Oct 2026Updated 9 Oct 2026

8.7HighCVSS 4.0
CVE ID
CVE-2026-107725
GHSA ID
GHSA-w294-6q5q-53p8
EPSS
0.38%higher than 30% of CVEs
Weakness (CWE)
KEV status
Not in KEV
Published
8 Oct 2026
Updated
9 Oct 2026
Ecosystem
  • Maven
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Impact

Missing authorization checks in the Predicates API may allow a malicious client to execute arbitrary code on a Hazelcast member.

Patches

Enterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition:

  • 5.7.0
  • 5.6.1
  • 5.5.10
  • 5.4.5

Customers with extended support contracts should contact Hazelcast Support for information on patches for older versions.

Community Edition users should upgrade to version 5.7.0.

Workarounds

None - customers are advised to upgrade to a fixed version as soon as possible.

Technical details

Source: GitHub Advisory Database

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

High8.7Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Attack Requirements AT
None
Privileges Required PR
Low
User Interaction UI
None
Confidentiality (Vulnerable System) VC
High
Integrity (Vulnerable System) VI
High
Availability (Vulnerable System) VA
High
Confidentiality (Subsequent Systems) SC
None
Integrity (Subsequent Systems) SI
None
Availability (Subsequent Systems) SA
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • com.hazelcast:hazelcast
    Maven
    pkg:maven/com.hazelcast/hazelcast
    Affected versions
    = 5.6.0
    >= 5.5.0, < 5.5.10
    < 5.4.5
    Fixed in
    5.7.0
    Show 270 listed versions
    • 5.6.0
    • 5.5.0
    • 5.6.0-BETA-1
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.6
    • 1.6-RC1
    • 1.7
    • 1.7-RC1
    • 1.7-RC2

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 5.7.0 or later.

Patch commits

  • 5d68f48Patch commitgithub.com/hazelcast/hazelcast

    Add missing IMap aggregate and projection permissions [CTT-991] (#5991)

    +9 −1 across 1 file

    • hazelcast/src/main/java/com/hazelcast/security/permission/MapPermission.java+9 −1

Vulnerability intelligence

References

Credits

Questions about CVE-2026-107725

What is the GHSA ID for CVE-2026-107725?
GitHub tracks CVE-2026-107725 as GHSA-w294-6q5q-53p8.
What is the CVSS score of CVE-2026-107725?
CVE-2026-107725 has a CVSS 4.0 base score of 8.7 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
Which versions are affected by CVE-2026-107725?
com.hazelcast:hazelcast (Maven): = 5.6.0; >= 5.5.0, < 5.5.10; < 5.4.5.
How do I fix CVE-2026-107725?
Upgrade to 5.7.0 or later. The fix is in commit 5d68f48.
What is the Package URL (PURL) for CVE-2026-107725?
The affected package's PURL is pkg:maven/com.hazelcast/hazelcast.
Is CVE-2026-107725 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-107725. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (14 Oct 2026, 17:50 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.