Description
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hazelcast | hazelcast | < 5.4.5, >= 5.5.0, < 5.5.10, >= 5.6.0, < 5.6.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.hazelcast:hazelcast | >= 5.6.0, < 5.7.0 | 5.7.0 | GHSA-w294-6q5q-53p8 |
| Maven | com.hazelcast:hazelcast | >= 5.5.0, < 5.7.0 | 5.7.0 | GHSA-w294-6q5q-53p8 |
| Maven | com.hazelcast:hazelcast | < 5.7.0 | 5.7.0 | GHSA-w294-6q5q-53p8 |
Advisories 1
- WID-SEC-2026-3846 Hazelcast: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026