Hazelcast flaw lets low-privileged clients read member memory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Hazelcast before 5.4.5, from 5.5.0 before 5.5.10, and from 5.6.0 before 5.6.1 are affected, as is the Maven package com.hazelcast:hazelcast before 5.7.0. Improper input validation (CWE-20) lets a malicious client that can connect to a cluster read arbitrary data from a member's Java heap, off-heap memory, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hazelcast | hazelcast | before 5.4.5; 5.5.0 to before 5.5.10; 5.6.0 to before 5.6.1 | 5.4.5, 5.5.10, 5.6.1 | Patch available | CNA |
| — | com.hazelcast:hazelcast (Maven) | 5.6.0 to before 5.7.0 | 5.7.0 | Patch available | GHSA-6v25-8wq6-xq4j |
| — | com.hazelcast:hazelcast (Maven) | 5.5.0 to before 5.7.0 | 5.7.0 | Patch available | GHSA-6v25-8wq6-xq4j |
| — | com.hazelcast:hazelcast (Maven) | before 5.7.0 | 5.7.0 | Patch available | GHSA-6v25-8wq6-xq4j |
- hazelcast Vendorhazelcast Affected before 5.4.5; 5.5.0 to before 5.5.10; 5.6.0 to before 5.6.1 Fixed in 5.4.5, 5.5.10, 5.6.1 Patch available CNA
- com.hazelcast:hazelcast (Maven) Vendor— Affected 5.6.0 to before 5.7.0 Fixed in 5.7.0 Patch available GHSA-6v25-8wq6-xq4j
- com.hazelcast:hazelcast (Maven) Vendor— Affected 5.5.0 to before 5.7.0 Fixed in 5.7.0 Patch available GHSA-6v25-8wq6-xq4j
- com.hazelcast:hazelcast (Maven) Vendor— Affected before 5.7.0 Fixed in 5.7.0 Patch available GHSA-6v25-8wq6-xq4j
Remediation
Upgrade Hazelcast to 5.4.5, 5.5.10, 5.6.1, or 5.7.0, and upgrade the com.hazelcast:hazelcast Maven package to 5.7.0.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA hazelcast (hazelcast) Fixed in 5.4.5, 5.5.10, 5.6.1
- Fix · GHSA-6v25-8wq6-xq4j com.hazelcast:hazelcast (Maven) Fixed in 5.7.0 Advisory →
- Fix · GHSA-6v25-8wq6-xq4j com.hazelcast:hazelcast (Maven) Fixed in 5.7.0 Advisory →
- Fix · GHSA-6v25-8wq6-xq4j com.hazelcast:hazelcast (Maven) Fixed in 5.7.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107726
- 2026-10-09 Alias added: GHSA-6v25-8wq6-xq4j
- 2026-10-10 Affected versions changed · Red Hat
- 2026-10-10 CVSS score added · Red Hat
- 2026-10-10 CISA SSVC decision points changed
- 2026-10-20 Affected versions changed · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
References
Other 6
- https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j
- https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f
- https://docs.hazelcast.com/hazelcast/5.7/release-notes/community
- https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise
- https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0
- https://github.com/hazelcast/hazelcast
More hazelcast vulnerabilities
- TI-2024-37405 Hazelcast Management Center through 6.0 allows remote code execution via a… CVSS 3.1CRITICAL 9.8
- TI-2022-16762 The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated… CVSS 3.1CRITICAL 9.1
- TI-2022-00199 Improper Restriction of XML External Entity Reference in hazelcast/hazelcast CVSS 3.1CRITICAL 9.8
- TI-2020-16001 The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before… CVSS 3.1CRITICAL 9.8
- TI-2016-08788 In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code… CVSS 3.0HIGH 8.1
- TI-2023-16430 In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services… CVSS 3.1HIGH 8.8
Sources
- CVE-2026-107726 · CVE Program
- CVE-2026-107726 · NVD
- FIRST EPSS
- GHSA-6v25-8wq6-xq4j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107726 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences