CVE-2026-107726: Hazelcast Arbitrary Memory Access Vulnerability
Summary
CVE-2026-107726: Hazelcast allows arbitrary member memory access by low-privileged client. Affects com.hazelcast:hazelcast across 3 version ranges.
>= 5.5.0, < 5.7.0
>= 5.6.0, < 5.7.0
< 5.7.0
Fixed in 5.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hazelcast is an open-source in-memory data grid that provides distributed data storage and processing capabilities. It is widely used for building scalable and high-performance applications. The software is available in both Community and Enterprise Editions, offering features like data partitioning, replication, and distributed computing. However, a critical vulnerability has been identified that allows low-privileged clients to access arbitrary memory from cluster members, posing significant security risks.
Vulnerability Detail
A flaw exists in both Hazelcast Enterprise and Community Editions that permits a low-privileged malicious client to read arbitrary data from the memory of any cluster member. This includes sensitive information stored in Java heap memory, off-heap data, and the JVM process address space. The vulnerability can lead to cluster member crashes and, in some configurations of the Enterprise Edition, memory corruption that may result in remote code execution. This vulnerability is classified under CWE-20, indicating improper input validation.
How To Fix
Latest published version: 5.7.0 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, restrict cluster access to trusted clients only and ensure that client applications are hardened against potential compromises. Implement firewall rules to protect the Hazelcast cluster.
Conclusion
The vulnerability CVE-2026-107726 in Hazelcast poses a significant risk by allowing low-privileged clients to access arbitrary memory from cluster members. Users are strongly advised to upgrade to the patched versions or implement the recommended workarounds to mitigate potential threats.
See every vulnerability recorded for com.hazelcast:hazelcast →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical severity level.
Versions of Hazelcast prior to 5.7.0 are affected, including 5.6.0, 5.5.0, and earlier.
Exploitation of this vulnerability can lead to unauthorized memory access, crashes of cluster members, and potential remote code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
Ensure that Hazelcast Security is enabled, enforce client authorization, define an explicit allowlist for serialization, and protect your cluster with appropriate firewall rules.
Related vulnerabilities
Recent vulnerabilities recorded for com.hazelcast:hazelcast.
