CVE-2026-107725 Hazelcast: Authorization bypass in IMap Predicates API
A malicious client with limited privileges can execute arbitrary code on a Hazelcast cluster member due to missing authorization checks in the IMap Predicates API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107725?
CVE-2026-107725 is a high-severity missing authorization vulnerability in hazelcast, published on 8 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-107725?
6 open source packages ship an affected version, including com.hazelcast:hazelcast.
| Package | Affected | Fixed in |
|---|---|---|
com.hazelcast:hazelcast Maven | All versions | 5.7.0 |
com.hazelcast:hazelcast Maven | All versions | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.5.0 | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.5.0 | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.6.0 | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.6.0 | 5.7.0 |
How do I fix CVE-2026-107725?
Upgrade com.hazelcast:hazelcast to 5.7.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-107725 being exploited?
There is no known exploitation of CVE-2026-107725 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-VX52649, GHSA-w294-6q5q-53p8, MINI-9rrm-rc2f-w2g2, MINI-q2wf-266x-8x2h, ROOT-APP-MAVEN-CVE-2026-107725.