CVE-2026-107725: 
Java vulnerability analysis and mitigation

CVE-2026-107725 is an authorization bypass vulnerability in Hazelcast's IMap Predicates API, classified as "Authorization bypass in IMap Predicates API" (GHSA-w294-6q5q-53p8). Missing authorization checks allow a malicious client with limited (low-privilege) credentials to execute arbitrary code on a Hazelcast cluster member. Affected versions include all releases prior to 5.4.5, versions 5.5.0–5.5.9, and version 5.6.0. The vulnerability was originally published on August 4, 2026, and publicly disclosed via the GitHub Advisory Database on October 8, 2026. It carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Hazelcast Advisory).

The root cause is CWE-862 (Missing Authorization): the IMap Predicates API — specifically the aggregate and projection operations — did not enforce the required AGGREGATE and PROJECTION permission checks before executing client-supplied predicates on cluster members (Hazelcast Advisory). The fix, committed as 5d68f48, added two new permission constants (AGGREGATE and PROJECTION) to MapPermission.java and wired them into the permission mask evaluation, closing the authorization gap (Patch Commit). Exploitation requires only low-privilege network access to the Hazelcast cluster — no special configuration or user interaction is needed — making the attack surface broad for any deployment that exposes the Hazelcast client port to partially trusted clients (Github Advisory).

Successful exploitation allows a low-privileged Hazelcast client to execute arbitrary code directly on a cluster member, resulting in full compromise of confidentiality, integrity, and availability of the affected node. An attacker could read or modify all data stored in IMap structures, disrupt cluster operations, or use the compromised member as a pivot point for lateral movement within the internal network. The impact is scoped to the vulnerable Hazelcast system itself, with no direct subsequent-system impact defined in the CVSS scoring, though real-world cluster compromise could expose sensitive application data processed by the platform (Hazelcast Advisory, Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date (Github Advisory). The EPSS score is 0.0, indicating a currently low probability of near-term exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. The vulnerability was discovered by researcher k-jamroz (Hazelcast Advisory).

1. Reconnaissance: Identify Hazelcast cluster members with exposed client ports (default: 5701) using network scanning tools such as Nmap or Shodan, targeting versions prior to 5.4.5, 5.5.0–5.5.9, or 5.6.0.
2. Obtain low-privilege credentials: Acquire any valid Hazelcast client credentials (e.g., a free trial account, a low-privilege service account, or credentials obtained through other means), as the vulnerability only requires PR:L (low privileges).
3. Connect as a Hazelcast client: Use the Hazelcast Java client library or compatible client to establish a connection to the target cluster member.
4. Invoke IMap aggregate/projection API without required permissions: Submit a crafted IMap aggregate or projection operation via the Predicates API. Because the server does not check for AGGREGATE or PROJECTION permissions, the operation is accepted and executed regardless of the client's actual authorization level.
5. Achieve arbitrary code execution: Supply a malicious predicate or aggregator implementation (e.g., a custom Aggregator or Projection class) that executes attacker-controlled code on the cluster member's JVM, enabling data exfiltration, persistence, or further lateral movement within the cluster (Hazelcast Advisory, Patch Commit).

• Network: Unexpected or anomalous Hazelcast client connections (TCP port 5701) from untrusted or external IP addresses; unusual volume of IMap aggregate or projection API calls from low-privilege client accounts.
• Logs: Hazelcast member logs showing execution of custom Aggregator or Projection classes from unrecognized or untrusted client principals; authorization-related log entries that are absent where they should appear for aggregate/projection operations.
• Process: Unexpected child processes spawned by the Hazelcast JVM process (e.g., bash, curl, wget, python) indicating code execution via a malicious predicate payload.
• File System: Unexpected class files, JAR files, or scripts written to the Hazelcast working directory or temp directories by the Hazelcast service account.

Hazelcast has released patched versions addressing this vulnerability: 5.4.5, 5.5.10, 5.6.1, and 5.7.0 for Enterprise Edition; Community Edition users should upgrade to 5.7.0. Customers with extended support contracts should contact Hazelcast Support for patches covering older versions. No configuration-based workaround is available — the vendor explicitly advises upgrading to a fixed version as soon as possible (Hazelcast Advisory, Github Advisory).