CVE-2026-107725: Hazelcast IMap Predicates API Authorization Bypass Vulnerability
Summary
CVE-2026-107725: Hazelcast has an authorization bypass in IMap Predicates API. Affects com.hazelcast:hazelcast across 3 version ranges.
>= 5.5.0, < 5.7.0
>= 5.6.0, < 5.7.0
< 5.7.0
Fixed in 5.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hazelcast is an open-source in-memory data grid that provides distributed data structures and computing capabilities. It is widely used for building scalable and high-performance applications. The IMap Predicates API allows users to query and manipulate data stored in Hazelcast's distributed maps. However, a critical vulnerability has been identified in this API that could allow unauthorized access and execution of arbitrary code.
Vulnerability Detail
The vulnerability arises from missing authorization checks in the Predicates API of Hazelcast. This oversight allows a malicious client to bypass security measures and execute arbitrary code on a Hazelcast member. The implications of this vulnerability are severe, as it could lead to unauthorized data access, data manipulation, and potential compromise of the entire Hazelcast cluster.
How To Fix
Latest published version: 5.7.0 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds for this vulnerability. Users are strongly advised to upgrade to a fixed version as soon as possible.
Conclusion
The Hazelcast IMap Predicates API has a critical authorization bypass vulnerability that can lead to severe security risks. Users are urged to upgrade to the latest patched versions to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for com.hazelcast:hazelcast →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Both Hazelcast Enterprise and Community Edition users are affected, particularly those using versions prior to 5.7.0.
It is recommended to upgrade to a fixed version as soon as possible, as there are no effective workarounds for this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the pom.xml file.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for com.hazelcast:hazelcast.
