{"id":"CVE-2026-107725","aliases":["GHSA-w294-6q5q-53p8"],"url":"https://o3.security/vulnerability/CVE-2026-107725","summary":"Hazelcast: Authorization bypass in IMap Predicates API","details":"### Impact\n\nMissing authorization checks in the [Predicates API](https://docs.hazelcast.com/hazelcast/5.7/query/predicate-overview) may allow a malicious client to execute arbitrary code on a Hazelcast member.\n\n### Patches\n\nEnterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition:\n * 5.7.0\n * 5.6.1\n * 5.5.10\n * 5.4.5\n \nCustomers with extended support contracts should contact Hazelcast Support for information on patches for older versions.\n\nCommunity Edition users should upgrade to version 5.7.0.\n\n### Workarounds\nNone - customers are advised to upgrade to a fixed version as soon as possible.","published":"2026-10-08T22:04:28.446Z","modified":"2026-10-21T09:36:52.044205070Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"com.hazelcast:hazelcast","fixedVersion":"5.7.0"},{"ecosystem":"Maven","name":"com.hazelcast:hazelcast","fixedVersion":"5.7.0"},{"ecosystem":"Maven","name":"com.hazelcast:hazelcast","fixedVersion":"5.7.0"}],"fix":{"url":"https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0","label":"hazelcast/hazelcast@5d68f48"},"references":[{"type":"WEB","url":"https://docs.hazelcast.com/hazelcast/5.7/release-notes/community"},{"type":"WEB","url":"https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107725.json"},{"type":"ADVISORY","url":"https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107725"},{"type":"FIX","url":"https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0"},{"type":"WEB","url":"https://docs.hazelcast.com/hazelcast/5.7/release-notes/releases"},{"type":"PACKAGE","url":"https://github.com/hazelcast/hazelcast"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T09:36:52.044205070Z"}}