CVE-2026-107725: Remote Code Execution via Authorization Bypass in Hazelcast Predicates API

Hazelcast is an in-memory data grid solution designed for high-performance distributed caching, stream processing, and querying operations. The system uses a client-server architecture where clients connect to a cluster of nodes to store and retrieve data. Security in these setups is managed through role-based access control policies that authorize client interactions on specific distributed data structures like maps (IMap).

A critical authorization bypass exists in Hazelcast due to missing permission validations within the Predicates API. This API allows clients to query and aggregate data across distributed nodes. The vulnerability, tracked as CVE-2026-107725, stems from a failure to check authorization when clients invoke aggregations and projections. This omission permits authenticated users with low privileges to bypass standard security filters and execute unauthorized operations on the cluster members.

The consequence of this authorization bypass is arbitrary remote code execution on the server nodes. Because aggregators and projections run inside the cluster JVM to evaluate custom queries locally, bypassing the security manager allows low-privileged clients to deliver code-carrying payloads. The target server node deserializes and executes this logic, inheriting the operating system privileges of the Hazelcast process.

The technical flaw lies within the security authorization subsystem of Hazelcast, specifically within the implementation of the MapPermission class. In a secure Hazelcast deployment, client operations on distributed maps are intercepted and validated against configured security policies. The MapPermission class defines a bitmask representing the set of allowed actions on an IMap instance, including operations like create, read, put, and destroy.

Hazelcast defines action strings for aggregations and projections under ActionConstants.ACTION_AGGREGATE and ActionConstants.ACTION_PROJECTION. However, prior to the fix, the MapPermission class did not declare bitmask constants for these two operations, nor did it register them within its initialization method initMask(). Consequently, when a security interceptor queried MapPermission to verify if a client possessed authorization for an "aggregate" or "projection" action, the underlying logic evaluated the operation with an effective mask of NONE (zero).

Because the security framework did not map these action strings to valid, enforceable permissions, the cluster members defaulted to permitting the execution. The omission created a security gap where any client that could establish a valid connection and possessed basic permissions (such as reading a public map) could issue complex aggregation and projection operations. The server failed to validate whether the client possessed explicit permissions for these administrative-level data-processing tasks.

Analysis of the fix commit 5d68f4828e2a914398a39f12fe11cafd335cefe0 reveals how the authorization gap was addressed. The patch modifies the MapPermission class to declare bitwise positions for the missing actions. The constants AGGREGATE and PROJECTION are assigned to bits 9 and 10 respectively, ensuring they occupy distinct positions in the internal bitmask structure.

// Patched MapPermission.java structure
private static final int AGGREGATE = 1 << 9; // Bit 9 allocated for aggregation authorization
private static final int PROJECTION = 1 << 10; // Bit 10 allocated for projection authorization
private static final int ALL = CREATE | DESTROY | PUT | REMOVE | READ | LISTEN 
        | LOCK | INDEX | INTERCEPT | AGGREGATE | PROJECTION; // Combined permission bitmask

The implementation of the initMask() method was also updated. In the vulnerable version, the loop checking action strings completely ignored the "aggregate" and "projection" constants. The patch introduces explicit conditional branches to capture these string constants and binary-OR the corresponding bits onto the return mask.

// Action string translation within initMask()
} else if (ActionConstants.ACTION_AGGREGATE.equals(action)) {
    mask |= AGGREGATE; // Apply aggregation bit to the permission mask
} else if (ActionConstants.ACTION_PROJECTION.equals(action)) {
    mask |= PROJECTION; // Apply projection bit to the permission mask
}

While this fix successfully registers and enforces authorization checks for these APIs, security administrators must ensure that custom policies are updated. If client roles are configured with wildcard permissions, they will automatically inherit these new actions. Organizations should review active client policies to confirm that only authorized, high-privileged service accounts possess the newly introduced permissions.

To exploit this vulnerability, an attacker must first obtain valid network access to the Hazelcast cluster and possess credentials for a low-privileged client. This requirement is met if the attacker has access to a standard application client configuration or can compromise a system that interacts with any map on the cluster. The attacker does not need administrative privileges or write access to the targeted map.

The attack vector leverages the Predicates API to deliver a custom Aggregator or Projection class over the Hazelcast serialization protocol. The attacker constructs a client script that connects to the cluster and obtains a reference to a map. Instead of standard read or write commands, the client invokes the aggregate() method, supplying a malicious object designed to execute administrative actions or system commands upon deserialization.

Once received by the server node, the request is routed to the partition threads for local execution. Because the aggregate operation bypasses authorization, the server node processes the payload immediately. The server deserializes the malicious aggregator class and executes its logic within the server process context, resulting in code execution on the underlying host operating system.

The impact of successful exploitation is a complete compromise of the confidentiality, integrity, and availability of the affected Hazelcast cluster. An attacker can execute arbitrary Java code on any active cluster member. Since Hazelcast instances often run with elevated privileges or access sensitive back-end databases, the compromise can extend to the wider infrastructure.

From a data confidentiality standpoint, arbitrary code execution allows attackers to dump the entire contents of all memory-resident maps, cache stores, and underlying databases. This can expose sensitive customer data, API keys, and corporate secrets. The integrity of the cluster is also compromised, as the attacker can manipulate transactions, alter cache records silently, or modify persistent file stores.

The CVSS v4.0 score of 8.7 reflects the severity of the vulnerability. The low complexity of the attack coupled with the high impact on confidentiality, integrity, and availability makes this a critical security concern. Although the vulnerability requires authentication, the low privilege requirement means any system-compromised client or internal threat actor can initiate the exploit.

The primary mitigation strategy is upgrading the Hazelcast installation to a patched release. Administrators should apply Hazelcast version 5.4.5, 5.5.10, 5.6.1, or 5.7.0 depending on their current release line. These releases contain the updated MapPermission logic that enforces authorization checks on all aggregate and projection requests.

If immediate upgrading is not possible, security teams must deploy defensive workarounds. One critical defense is disabling client-side User Code Deployment. This feature allows clients to upload class definitions dynamically to server nodes, which facilitates the execution of custom aggregators. Disabling this capability in the hazelcast.xml configuration prevents attackers from injecting custom classes.

<user-code-deployment enabled="false">
    <!-- Disabling dynamic class loading restricts external code injection -->
</user-code-deployment>

Additionally, implementing strict Java serialization filters (Object Filtering) helps block unauthorized classes from being deserialized by the JVM. Organizations should define a whitelist of permitted classes for serialization and reject any custom or unrecognized aggregators. Access control lists should be hardened to restrict cluster-level network connections to trusted systems only.