# CVE-2026-107725: Hazelcast has an authorization bypass in IMap Predicates API

> CVE-2026-107725 (GitHub advisory GHSA-w294-6q5q-53p8) is a high-severity vulnerability with a CVSS 4.0 base score of 8.7, classed as Missing Authorization (CWE-862), in com.hazelcast:hazelcast (Maven). Affected versions: = 5.6.0; >= 5.5.0, < 5.5.10; < 5.4.5. It is fixed in 5.7.0.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-107725

| Field | Value |
| --- | --- |
| CVE | CVE-2026-107725 |
| GHSA | GHSA-w294-6q5q-53p8 |
| Severity | High |
| CVSS 4.0 | 8.7 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` (GitHub Advisory Database) |
| CWE | CWE-862 Missing Authorization |
| EPSS | 0.38% (higher than 30% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact total |
| Published | 8 Oct 2026 |
| Modified | 9 Oct 2026 |

## Description

##### Impact

Missing authorization checks in the [Predicates API](https://docs.hazelcast.com/hazelcast/5.7/query/predicate-overview) may allow a malicious client to execute arbitrary code on a Hazelcast member.

##### Patches

Enterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition:
 * 5.7.0
 * 5.6.1
 * 5.5.10
 * 5.4.5
 
Customers with extended support contracts should contact Hazelcast Support for information on patches for older versions.

Community Edition users should upgrade to version 5.7.0.

##### Workarounds
None - customers are advised to upgrade to a fixed version as soon as possible.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| com.hazelcast:hazelcast | Maven | `pkg:maven/com.hazelcast/hazelcast` | = 5.6.0; >= 5.5.0, < 5.5.10; < 5.4.5 | 5.7.0 |

## Fix commits

- Patch: https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0

## Questions

**What is the GHSA ID for CVE-2026-107725?**

GitHub tracks CVE-2026-107725 as GHSA-w294-6q5q-53p8.

**What is the CVSS score of CVE-2026-107725?**

CVE-2026-107725 has a CVSS 4.0 base score of 8.7 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

**Which versions are affected by CVE-2026-107725?**

com.hazelcast:hazelcast (Maven): = 5.6.0; >= 5.5.0, < 5.5.10; < 5.4.5.

**How do I fix CVE-2026-107725?**

Upgrade to 5.7.0 or later. The fix is in commit 5d68f48.

**What is the Package URL (PURL) for CVE-2026-107725?**

The affected package's PURL is pkg:maven/com.hazelcast/hazelcast.

**Is CVE-2026-107725 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-107725. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30% of CVEs.

## References

- https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0 (fix)
- https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107725.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-107725 (advisory)
- https://github.com/advisories/GHSA-w294-6q5q-53p8 (advisory)
- https://github.com/hazelcast/hazelcast (package)
- https://docs.hazelcast.com/hazelcast/5.7/release-notes/community
- https://docs.hazelcast.com/hazelcast/5.7/release-notes/releases
- https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-107725), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.