{"uuid": "5ddbebc2-6383-4e5d-84a7-cb949bcba018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107725", "type": "seen", "source": "https://gist.github.com/alon710/0532ac2f6f03e22488087193ef4f5f12", "content": "# CVE-2026-107725: CVE-2026-107725: Remote Code Execution via Authorization Bypass in Hazelcast Predicates API\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107725\n\n## Summary\nCVE-2026-107725 is a critical security bypass in Hazelcast where missing authorization checks in the MapPermission class permit unprivileged clients to issue queries containing aggregators or projections. This architectural oversight allows attackers to run arbitrary code on the cluster servers under the privileges of the active Hazelcast process.\n\n## TL;DR\nAn authorization bypass vulnerability in Hazelcast versions prior to 5.4.5, 5.5.10, and 5.6.1 allows authenticated users with minimal permissions to execute arbitrary Java code on cluster nodes by sending crafted aggregation or projection requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 8.7 (CVSS v4.0)\n- **EPSS Score**: 0.01 (Estimated)\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof-of-Concept Stage / Private\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Hazelcast Community Edition\n- Hazelcast Enterprise Edition\n- **Hazelcast**: < 5.4.5 (Fixed in: `5.4.5`)\n- **Hazelcast**: >= 5.5.0, < 5.5.10 (Fixed in: `5.5.10`)\n- **Hazelcast**: >= 5.6.0, < 5.6.1 (Fixed in: `5.6.1`)\n\n## Mitigation\n\n- Upgrade to patched Hazelcast versions (5.4.5, 5.5.10, 5.6.1, or 5.7.0)\n- Disable client-side User Code Deployment in cluster configuration\n- Enforce custom Java serialization filters (ObjectFilter) to block untrusted payloads\n- Restrict network access to the cluster ports to trusted systems only\n\n**Remediation Steps:**\n1. Identify all running Hazelcast instances and check their version numbers.\n2. Apply upgrades to version 5.4.5, 5.5.10, 5.6.1, or 5.7.0 as appropriate.\n3. Review client security roles and ensure permission configurations do not grant excessive privileges.\n4. Modify hazelcast.xml to disable user-code-deployment if dynamic class loading is not required.\n\n## References\n\n- [GitHub Security Advisory GHSA-w294-6q5q-53p8](https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8)\n- [NVD Official CVE Record](https://nvd.nist.gov/vuln/detail/CVE-2026-107725)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-107725)\n- [Hazelcast Patch Commit](https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0)\n- [Hazelcast Community Release Notes](https://docs.hazelcast.com/hazelcast/5.7/release-notes/community)\n- [Hazelcast Enterprise Release Notes](https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise)\n- [Hazelcast Predicates API Overview](https://docs.hazelcast.com/hazelcast/5.7/query/predicate-overview)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107725) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T07:30:30.000000Z"}