CVE-2026-107725

A flaw was found in Hazelcast. Due to missing authorization checks within the IMap Predicates application programming interface (API), an authenticated client with limited privileges can bypass access controls. This vulnerability allows an attacker to achieve arbitrary code execution on a cluster member, compromising the affected system.

Red Hat rates this vulnerability as Important because a client with limited privileges and network access to a vulnerable Hazelcast cluster member can execute arbitrary code without additional user interaction. Successful exploitation can compromise the confidentiality, integrity, and availability of resources accessible to the Hazelcast process. The requirement for an authenticated client with existing privileges distinguishes this issue from unauthenticated remote code execution that would warrant a Critical rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.