Hazelcast IMap Predicates API Authorization Bypass

Executive Summary

A critical vulnerability (CVE-2026-107725) with a CVSS score of 8.7 was discovered in Hazelcast's IMap Predicates API. This authorization bypass flaw allows a malicious client to execute arbitrary code on a Hazelcast member. The vulnerability affects multiple versions of Hazelcast, including 5.6.0, 5.5.0-5.5.9, and 5.4.0-5.4.4.

Technical Analysis

The vulnerability is caused by missing authorization checks in the IMap Predicates API. This classifies as a CWE-862 (Missing Authorization) vulnerability. An attacker can exploit this flaw by sending a crafted request to the Predicates API, potentially leading to arbitrary code execution on the Hazelcast member.

How It Gets Exploited

An attacker with a low-privileged client connection to the Hazelcast cluster can exploit this vulnerability. The attacker would send a specially crafted request to the IMap Predicates API, taking advantage of the missing authorization checks. This could allow the attacker to execute arbitrary code on the Hazelcast member, potentially gaining elevated privileges and access to sensitive data.

Impact Assessment

The impact of this vulnerability is severe, with a CVSS score of 8.7. Successful exploitation could allow an attacker to execute arbitrary code on the Hazelcast member, potentially leading to data breaches, system compromise, or denial-of-service attacks. Affected versions include: - Hazelcast 5.6.0 - Hazelcast 5.5.0-5.5.9 - Hazelcast 5.4.0-5.4.4

Recommended Actions

To mitigate this vulnerability, users are advised to upgrade to the following fixed versions: - Hazelcast Enterprise Edition: 5.7.0, 5.6.1, 5.5.10, or 5.4.5 - Hazelcast Community Edition: 5.7.0 Customers with extended support contracts should contact Hazelcast Support for patches for older versions. No workarounds are available, and immediate upgrade to a fixed version is strongly recommended.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-w294-6q5q-53p8