hazelcast

CVE-2026-107725: CVE-2026-107725: Remote Code Execution via Authorization Bypass in Hazelcast Predicates API CVE-2026-107725: Remote Code Execution via Authorization Bypass in Hazelcast Predicates API > Vulnerability ID: CVE-2026-107725 > CVSS Score: 8.7 > Published: 2026-10-08 CVE-2026-107725 is a critical security bypass in Hazelcast where missing authorization checks in the MapPermission class permit unprivileged clients to issue queries containing aggregators or projections. This architectural oversight allows attackers to run arbitrary code on the cluster servers under the privileges of the active Hazelcast process. TL;DR An authorization bypass vulnerability in Hazelcast versions prior to 5.4.5, 5.5.10, and 5.6.1 allows authenticated users with minimal permissions to execute arbitrary Java code on cluster nodes by sending crafted aggregation or projection requests. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-862 - Attack Vector: Network - CVSS Score: 8.7 (CVSS v4.0) - EPSS Score: 0.01 (Estimated) - Impact: Remote Code Execution (RCE) - Exploit Status: Proof-of-Concept Stage / Private - KEV Status: Not Listed Affected Systems - Hazelcast Community Edition - Hazelcast Enterprise Edition - Hazelcast: < 5.4.5 (Fixed in: 5.4.5) - Hazelcast: >= 5.5.0, < 5.5.10 (Fixed in: 5.5.10) - Hazelcast: >= 5.6.0, < 5.6.1 (Fixed in: 5.6.1) Code Analysis Commit: 5d68f48 Add AGGREGATE and PROJECTION actions to MapPermission security configurations @@ -25,12 +25,16 @@ public class MapPermission extends InstancePermission { private static final int LOCK = 64; private static final int INDEX = 128; private static final int INTERCEPT = 256; - private static final int ALL = CREATE | DESTROY | PUT | REMOVE | READ | LISTEN | LOCK | INDEX | INTERCEPT; + private static final int AGGREGATE = 1 << 9; + private static final int PROJECTION = 1 << 10; + private static final int ALL = CREATE | DESTROY | PUT | REMOVE | READ | LISTEN + | LOCK | INDEX | INTERCEPT | AGGREGATE | PROJECTION; public MapPermission(String name, String... actions) { super(name, actions); } + @SuppressWarnings("checkstyle:CyclomaticComplexity") @Override protected int initMask(String[] actions) { int mask = NONE; @@ -57,6 +61,10 @@ protected int initMask(String[] actions) { mask |= INDEX; } else if (ActionConstants.ACTION_INTERCEPT.equals(action)) { mask |= INTERCEPT; + } else if (ActionConstants.ACTION_AGGREGATE.equals(action)) { + mask |= AGGREGATE; + } else if (ActionConstants.ACTION_PROJECTION.equals(action)) { + mask |= PROJECTION; } } return mask; Mitigation Strategies - Upgrade to patched Hazelcast versions (5.4.5, 5.5.10, 5.6.1, or 5.7.0) - Disable client-side User Code Deployment in cluster configuration - Enforce custom Java serialization filters (ObjectFilter) to block untrusted payloads - Restrict network access to the cluster ports to trusted systems only Remediation Steps: 1. Identify all running Hazelcast instances and check their version numbers. 2. Apply upgrades to version 5.4.5, 5.5.10, 5.6.1, or 5.7.0 as appropriate. 3. Review client security roles and ensure permission configurations do not grant excessive privileges. 4. Modify hazelcast.xml to disable user-code-deployment if dynamic class loading is not required. References - GitHub Security Advisory GHSA-w294-6q5q-53p8 - NVD Official CVE Record - CVE.org Authority Record - Hazelcast Patch Commit - Hazelcast Community Release Notes - Hazelcast Enterprise Release Notes - Hazelcast Predicates API Overview --- Read the full report for CVE-2026-107725 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-107726: CVE-2026-107726: Unrestricted Deserialization in Hazelcast Zero Config Compact Serialization CVE-2026-107726: Unrestricted Deserialization in Hazelcast Zero Config Compact Serialization > Vulnerability ID: CVE-2026-107726 > CVSS Score: 9.3 > Published: 2026-10-08 Improper validation of dynamic class resolution within Hazelcast's Zero Config Compact Serialization allows unauthenticated clients to trigger reflective class instantiation. This flaw can be exploited to read arbitrary JVM heap or off-heap memory, crash cluster nodes, or achieve arbitrary code execution under specific classpath conditions. This issue is resolved in Hazelcast versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0. TL;DR Hazelcast Zero Config Compact Serialization permits arbitrary reflective class instantiation, causing sensitive memory leaks, Denial of Service, or remote code execution. --- Technical Details - CWE ID: CWE-20 - Attack Vector: Network - CVSS v4.0: 9.3 (Critical) - EPSS Score: Not Available - Exploit Status: none - KEV Status: Not Listed Affected Systems - Hazelcast Community Edition - Hazelcast Enterprise Edition - Hazelcast Community Edition: < 5.4.5 (Fixed in: 5.4.5) - Hazelcast Community Edition: >= 5.5.0, < 5.5.10 (Fixed in: 5.5.10) - Hazelcast Community Edition: == 5.6.0 (Fixed in: 5.6.1) Code Analysis Commit: 361979d Reflective compact serialization filtering [CTT-687] (#6053) Exploit Details - Vendor Advisory: Official security advisory for CVE-2026-107726 detailing the dynamic serialization flaw and remediation Mitigation Strategies - Upgrade Hazelcast to the latest secure versions (5.4.5, 5.5.10, 5.6.1, or 5.7.0+) - Configure custom blocklists and allowlists using the zero-config-filter element - Deploy network microsegmentation to restrict access to Hazelcast ports (default 5701) Remediation Steps: 1. Identify all Hazelcast deployments in the environment and determine their current version. 2. Download and apply updates for Hazelcast Community or Enterprise Edition according to the release guidance. 3. If upgrading is delayed, edit hazelcast.xml or hazelcast.yaml to define a zero-config-filter restrictively. 4. Restart the cluster members sequentially to apply the new configurations and ensure secure serialization policies are active. References - GitHub Security Advisory GHSA-6v25-8wq6-xq4j - Hazelcast Community Edition 5.7.0 Release Notes --- Read the full report for CVE-2026-107726 on our website for more details including interactive diagrams and full exploit analysis.