CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client
A malicious client can read arbitrary memory, crash cluster members, or potentially execute code via memory corruption in Hazelcast.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107726?
CVE-2026-107726 is a critical memory corruption vulnerability in hazelcast, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Weakness: CWE-20
Which versions are affected by CVE-2026-107726?
6 open source packages ship an affected version, including com.hazelcast:hazelcast.
| Package | Affected | Fixed in |
|---|---|---|
com.hazelcast:hazelcast Maven | All versions | 5.7.0 |
com.hazelcast:hazelcast Maven | All versions | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.5.0 | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.5.0 | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.6.0 | 5.7.0 |
com.hazelcast:hazelcast Maven | From 5.6.0 | 5.7.0 |
How do I fix CVE-2026-107726?
Upgrade com.hazelcast:hazelcast to 5.7.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-107726 being exploited?
There is no known exploitation of CVE-2026-107726 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-JE76711, GHSA-6v25-8wq6-xq4j, MINI-4f96-hgw5-pvqv, MINI-fmg6-59ph-qc99, ROOT-APP-MAVEN-CVE-2026-107726.