CVE-2026-107725 in Hazelcast
Summary
by MITRE • 10/09/2026
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
Hazelcast serves as a unified real-time data platform that integrates stream processing capabilities with an in-memory fast data store, enabling organizations to build scalable and responsive applications. The software architecture relies heavily on distributed computing principles where multiple cluster members coordinate to manage stateful operations across the network. Within this ecosystem, the IMap Predicates API provides developers with mechanisms to query and filter data stored within Hazelcast maps based on specific criteria. This functionality is critical for efficient data retrieval in high-throughput environments but requires strict security controls to prevent unauthorized access or manipulation of cluster resources.
A significant vulnerability was identified in versions prior to 5.4.5, 5.5.10, and 5.6.1 regarding the authorization checks associated with the IMap Predicates API. The core technical flaw lies in a missing authorization check that allows any authenticated client, even those possessing limited privileges or restricted roles within the cluster, to execute arbitrary code on Hazelcast cluster members. This defect effectively bypasses the intended security boundaries of the application layer, granting attackers capabilities far beyond their assigned permissions. By exploiting this gap, an adversary can inject malicious payloads into the predicate evaluation process, leading to remote code execution (RCE) on the targeted server nodes.
The operational impact of this vulnerability is severe due to its potential for complete system compromise. Since Hazelcast clusters often handle sensitive business data and mission-critical transactions, unauthorized code execution can lead to data exfiltration, integrity violations, or denial of service conditions. Attackers with limited privileges typically have a lower barrier to entry compared to those requiring administrative access, making this vulnerability particularly dangerous in multi-tenant environments where privilege separation is expected but not enforced at the API level. The ability to execute arbitrary code means that an attacker could potentially take control of the underlying operating system on cluster members, pivot to other systems within the network, or disrupt service availability for all users relying on the platform.
This issue aligns with CWE-269, which describes Improper Privilege Management, specifically where a user is able to perform actions that exceed their assigned privileges. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques related to Remote Code Execution and potentially Command and Control if the executed code establishes persistent backdoors or communicates with external command servers. The lack of proper access control enforcement represents a critical failure in defense-in-depth strategies, highlighting the necessity for rigorous input validation and permission verification at every layer of the application stack.
To mitigate this risk, organizations running affected versions must immediately upgrade to patched releases including 5.4.5, 5.5.10, 5.6.1, or later versions such as 5.7.0 where these authorization checks have been properly implemented and tested. Beyond immediate patching, it is advisable for security teams to review their Hazelcast configurations to ensure that the principle of least privilege is strictly enforced across all client connections. Monitoring logs for unusual predicate-based queries from low-privilege accounts can also help in detecting potential exploitation attempts before they result in full system compromise. Regular audits and penetration testing focused on API-level authorization flaws are recommended to maintain robust security posture within distributed data platforms.