CVE-2026-107726: Hazelcast allows arbitrary member memory access by low-privileged client
A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to read arbitrary data in memory from any cluster member (including Java heap memory, off-heap data, and JVM process address space). Additionally, such a client may be able to cause one or more cluster members to crash, or in some Enterprise Edition configurations also corrupt memory contents, potentially leading to remote code execution. Both slim and full distributions are affected.
References
- docs.hazelcast.com/hazelcast/5.7/release-notes/community
- docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise
- github.com/advisories/GHSA-6v25-8wq6-xq4j
- github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f
- github.com/hazelcast/hazelcast/releases/tag/v5.7.0
- github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j
- nvd.nist.gov/vuln/detail/CVE-2026-107726
Code Behaviors & Features
Detect and mitigate CVE-2026-107726 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →