CVE-2026-107726
Hazelcast allows arbitrary member memory access by low-privileged client
A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to read arbitrary data in memory from any cluster member (including Java heap memory, off-heap data, and JVM process address space).
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v4.0)
- EPSS
- 0.38% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- com.hazelcast:hazelcast (maven) = 5.6.0, fixed in 5.7.0 · GHSA-6v25-8wq6-xq4j
- com.hazelcast:hazelcast (maven) >= 5.5.0, < 5.5.10, fixed in 5.7.0 · GHSA-6v25-8wq6-xq4j
- com.hazelcast:hazelcast (maven) < 5.4.5, fixed in 5.7.0 · GHSA-6v25-8wq6-xq4j