PT-2026-108681

Published

2026-10-08

·

Updated

2026-10-08

Description by

CVSS 4.0
8.7
High
MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Impact

Missing authorization checks in the Predicates API may allow a malicious client to execute arbitrary code on a Hazelcast member.

Patches

Enterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition:
  • 5.7.0
  • 5.6.1
  • 5.5.10
  • 5.4.5
Customers with extended support contracts should contact Hazelcast Support for information on patches for older versions.
Community Edition users should upgrade to version 5.7.0.

Workarounds

None - customers are advised to upgrade to a fixed version as soon as possible.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
GHSA-W294-6Q5Q-53P8
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com