StackRadar

CVE-2026-107725

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
45
of 18,176 indexed, latest versions
Container images
51
deployed by those charts
Fix available
1 of 1
affected package

Hazelcast has an authorization bypass in IMap Predicates API

Carried by container images the latest versions of 45 of 18,176 indexed charts deploy, on 51 images.

Affected packageAffected versionsFixed inImages
hazelcastmaven3.5.4.wso2v2, 3.7.5, 3.8.6, 3.10.3+20 more5.7.051
OSV records
GHSA-w294-6q5q-53p8

Charts affected

45 by stars
ChartLatestAffected imagesRadar Score
sonarqubesonarqubeVerified publisher10.0.0+5211 of 3See more

sonarqube sonarqube 10.0.0+521

1 of the 3 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/sonarqube:10.0.0-communityef9723cf4fe4
hazelcast@5.2.1
5.7.0

Open the chart page →

7,236
sonarqube-ltssonarqubeVerified publisher1.0.16+981 of 4See more

sonarqube-lts sonarqube 1.0.16+98

1 of the 4 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/sonarqube:8.9.2-community88cd63154d4b
hazelcast@4.2
5.7.0

Open the chart page →

4,248
sonarqube-dcesonarqubeVerified publisher0.1.2+1212 of 5See more

sonarqube-dce sonarqube 0.1.2+121

2 of the 5 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/sonarqube:9.1.0-datacenter-search7e43ff493a47
hazelcast@4.2
5.7.0
library/sonarqube:9.1.0-datacenter-appa9bc5a3a1fc3
hazelcast@4.2
5.7.0

Open the chart page →

9,078
aegraviteeioVerified publisher3.0.21 of 1See more

ae graviteeio 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
graviteeio/ae-engine:3.0.24140932887e0
hazelcast@5.5.0
5.7.0

Open the chart page →

1,594
hazelcasthazelcastVerified publisher5.11.01 of 2See more

hazelcast hazelcast 5.11.0

1 of the 2 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.5.05dd5d31c7a06
hazelcast@5.5.0
5.7.0

Open the chart page →

2,048
icat-k8salba-helm-chartsVerified publisher1.1.02 of 4See more

icat-k8s alba-helm-charts 1.1.0

2 of the 4 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
payara/micro:7.2026.2-jdk25fb44b8ce1cb2
hazelcast@5.3.8-payara-1
5.7.0
payara/server-full:7.2026.2-jdk2531f1253f0cf8
hazelcast@5.3.8-payara-1
5.7.0

Open the chart page →

4,757
amorphieamorphie0.1.23 of 18See more

amorphie amorphie 0.1.2

3 of the 18 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.3.18fe26efde8e1
hazelcast@5.3.1
5.7.0
hazelcast/management-center:5.3.2f9d34300d330
hazelcast@5.3.1
5.7.0
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
hazelcast@5.3.6
5.7.0

Open the chart page →

35,586
arlas-aiasarlas-stackVerified publisher28.9.03 of 22See more

arlas-aias arlas-stack 28.9.0

3 of the 22 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gisaia/arlas-permissions-server:28.0.0e612fc722e02
hazelcast@5.6.0
5.7.0
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
hazelcast@5.6.0
5.7.0
gisaia/arlas-server:28.0.04e693e7b6f37
hazelcast@5.6.0
5.7.0

Open the chart page →

48,024
arlas-servicesarlas-stackVerified publisher28.9.03 of 3See more

arlas-services arlas-stack 28.9.0

3 of the 3 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gisaia/arlas-permissions-server:28.0.0e612fc722e02
hazelcast@5.6.0
5.7.0
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
hazelcast@5.6.0
5.7.0
gisaia/arlas-server:28.0.04e693e7b6f37
hazelcast@5.6.0
5.7.0

Open the chart page →

2,147
hazelcastcloudnativeapp1.3.11 of 1See more

hazelcast cloudnativeapp 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
hazelcast/hazelcast:3.11.2ca7d5589744f
hazelcast@3.11.2
5.7.0

Open the chart page →

5,049
hazelcast-jetcloudnativeapp1.1.01 of 1See more

hazelcast-jet cloudnativeapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:3.0df495e64ea65
hazelcast@3.12
5.7.0

Open the chart page →

5,398
neo4jcloudnativeapp1.0.01 of 1See more

neo4j cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/neo4j:3.4.5-enterprisea1ba477fa412
hazelcast@3.7.5
5.7.0

Open the chart page →

2,886
orientdbcloudnativeapp0.1.21 of 2See more

orientdb cloudnativeapp 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/orientdb:3.0.1318a6c004398f
hazelcast@3.10.4
5.7.0

Open the chart page →

1,857
mod-erm-usage-harvesterfolio-org0.1.341 of 1See more

mod-erm-usage-harvester folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
folioci/mod-erm-usage-harvester:latest2d6767933c59
hazelcast@5.3.8
5.7.0

Open the chart page →

567
mod-remote-storagefolio-org0.1.321 of 1See more

mod-remote-storage folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
folioci/mod-remote-storage:latest4f12177123dc
hazelcast@5.5.0
5.7.0

Open the chart page →

572
okapifolio-org0.3.311 of 1See more

okapi folio-org 0.3.31

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
folioci/okapi:latestdf29ac807a45
hazelcast@5.6.0
5.7.0

Open the chart page →

48
hazelcast-jethazelcastVerified publisher1.17.11 of 1See more

hazelcast-jet hazelcast 1.17.1

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
hazelcast@4.2.4
5.7.0

Open the chart page →

6,663
nexus3huangchengwu-helm-chart0.1.01 of 1See more

nexus3 huangchengwu-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
sonatype/nexus3:3.53.04bd975493104
hazelcast@3.12.13
5.7.0

Open the chart page →

4,803
daveit-at-mOfficialVerified publisher0.2.184 of 9See more

dave it-at-m 0.2.18

4 of the 9 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
hazelcast@5.5.0
5.7.0
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
hazelcast@5.5.0
5.7.0
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
hazelcast@5.5.0
5.7.0
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
hazelcast@5.5.0
5.7.0

Open the chart page →

15,957
refarch-gatewayit-at-mVerified publisher1.10.01 of 1See more

refarch-gateway it-at-m 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/refarch/refarch-gateway:1.10.0d74e6a31e2fe
hazelcast@5.5.0
5.7.0

Open the chart page →

343
refarch-templatesit-at-mVerified publisher2.3.01 of 1See more

refarch-templates it-at-m 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/refarch/refarch-gateway:1.10.0d74e6a31e2fe
hazelcast@5.5.0
5.7.0

Open the chart page →

343
nexusjenkins-x0.1.371 of 1See more

nexus jenkins-x 0.1.37

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
hazelcast@3.10.3
5.7.0

Open the chart page →

13,327
kadeck-teamskadeck1.1.211 of 1See more

kadeck-teams kadeck 1.1.21

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
xeotek/kadeck:6.3.439a3b37a17c5
hazelcast@5.3.5
5.7.0

Open the chart page →

4,131
kadeck-webkadeck0.6.01 of 1See more

kadeck-web kadeck 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
xeotek/kadeck:4.2.94c6b04d9ce55
hazelcast@5.1.3
5.7.0

Open the chart page →

7,905
sonarqubekubesphereVerified publisher6.7.01 of 3See more

sonarqube kubesphere 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/sonarqube:8.9-communityeb2f0be32efd
hazelcast@4.2
5.7.0

Open the chart page →

2,430
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
hazelcast@5.3.5
5.7.0

Open the chart page →

7,472
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
hazelcast@4.2.4
5.7.0

Open the chart page →

13,925
smsf-dispatcheropenshift1.0.41 of 1See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
hazelcast@4.2.4
5.7.0

Open the chart page →

12,084
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
hazelcast@4.2.4
5.7.0

Open the chart page →

13,903
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
hazelcast@4.2.4
5.7.0

Open the chart page →

13,885
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
hazelcast@4.2.4
5.7.0

Open the chart page →

13,772
ussigw-coreopenshift1.0.41 of 1See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
gurolakman/ussigw-core:1.0.48739565c3ea2
hazelcast@4.2.4
5.7.0

Open the chart page →

13,429
app-configradar-baseVerified publisher1.7.31 of 1See more

app-config radar-base 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
hazelcast@5.4.0
5.7.0

Open the chart page →

2,538
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
hazelcast@5.2.5
5.7.0

Open the chart page →

4,168
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
hazelcast@5.4.0
5.7.0

Open the chart page →

4,844
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
hazelcast@3.12.13
5.7.0

Open the chart page →

5,162
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
hazelcast@3.11.4
5.7.0

Open the chart page →

14,377
sonarqubestakaterVerified publisher0.10.31 of 2See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/sonarqube:6.7.6-community0ae5169e3d0f
hazelcast@3.8.6
5.7.0

Open the chart page →

13,495
sonarqubewebencryptor6.7.31 of 3See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
library/sonarqube:8.2-communitya246bc64207e
hazelcast@3.12.3
5.7.0

Open the chart page →

6,340
hazelcastwener5.11.01 of 2See more

hazelcast wener 5.11.0

1 of the 2 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.5.05dd5d31c7a06
hazelcast@5.5.0
5.7.0

Open the chart page →

2,048
hazelcastwenerme5.11.01 of 2See more

hazelcast wenerme 5.11.0

1 of the 2 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.5.05dd5d31c7a06
hazelcast@5.5.0
5.7.0

Open the chart page →

2,048
am-pattern-1wso22.6.0-71 of 6See more

am-pattern-1 wso2 2.6.0-7

1 of the 6 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
wso2/wso2am:2.6.0fbe0f4059b74
hazelcast@3.5.4.wso2v2
5.7.0

Open the chart page →

33,603
am-pattern-2wso22.6.0-71 of 6See more

am-pattern-2 wso2 2.6.0-7

1 of the 6 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
wso2/wso2am:2.6.0fbe0f4059b74
hazelcast@3.5.4.wso2v2
5.7.0

Open the chart page →

33,603
ei-pattern-1wso26.6.0-33 of 6See more

ei-pattern-1 wso2 6.6.0-3

3 of the 6 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
wso2/wso2ei-analytics-dashboard:6.6.0526a1ccae902
hazelcast@3.12.2.wso2v1
5.7.0
wso2/wso2ei-analytics-worker:6.6.021e6b03449ac
hazelcast@3.12.2.wso2v1
5.7.0
wso2/wso2ei-integrator:6.6.0790cd8c3a5a2
hazelcast@3.12.2.wso2v1
5.7.0

Open the chart page →

52,890
is-pattern-1wso2is-pattern15.11.01 of 2See more

is-pattern-1 wso2is-pattern1 5.11.0

1 of the 2 container images this version deploys carry CVE-2026-107725.

Container imageDigestPackageFixed in
massimolauri/wso2is:5.11.0-centose08abf0ce767
hazelcast@3.12.2.wso2v1
5.7.0

Open the chart page →

6,339

Container images carrying it

51 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
hazelcast/hazelcast:5.5.05dd5d31c7a06
hazelcast@5.5.0
5.7.0
3
gisaia/arlas-permissions-server:28.0.0e612fc722e02
hazelcast@5.6.0
5.7.0
2
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
hazelcast@5.6.0
5.7.0
2
gisaia/arlas-server:28.0.04e693e7b6f37
hazelcast@5.6.0
5.7.0
2
wso2/wso2am:2.6.0fbe0f4059b74
hazelcast@3.5.4.wso2v2
5.7.0
2
ghcr.io/it-at-m/refarch/refarch-gateway:1.10.0d74e6a31e2fe
hazelcast@5.5.0
5.7.0
2
1dev/server:11.9.0cd5b12fe5471
hazelcast@5.3.5
5.7.0
1
atlassian/confluence-server:7.10.03b9222ab32ef
hazelcast@3.11.4
5.7.0
1
folioci/mod-erm-usage-harvester:latest2d6767933c59
hazelcast@5.3.8
5.7.0
1
folioci/mod-remote-storage:latest4f12177123dc
hazelcast@5.5.0
5.7.0
1
folioci/okapi:latestdf29ac807a45
hazelcast@5.6.0
5.7.0
1
graviteeio/ae-engine:3.0.24140932887e0
hazelcast@5.5.0
5.7.0
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
hazelcast@4.2.4
5.7.0
1
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
hazelcast@4.2.4
5.7.0
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
hazelcast@4.2.4
5.7.0
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
hazelcast@4.2.4
5.7.0
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
hazelcast@4.2.4
5.7.0
1
gurolakman/ussigw-core:1.0.48739565c3ea2
hazelcast@4.2.4
5.7.0
1
hazelcast/hazelcast:5.3.18fe26efde8e1
hazelcast@5.3.1
5.7.0
1
hazelcast/hazelcast:3.11.2ca7d5589744f
hazelcast@3.11.2
5.7.0
1
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
hazelcast@4.2.4
5.7.0
1
hazelcast/hazelcast-jet:3.0df495e64ea65
hazelcast@3.12
5.7.0
1
hazelcast/management-center:5.3.2f9d34300d330
hazelcast@5.3.1
5.7.0
1
library/neo4j:3.4.5-enterprisea1ba477fa412
hazelcast@3.7.5
5.7.0
1
library/orientdb:3.0.1318a6c004398f
hazelcast@3.10.4
5.7.0
1
library/sonarqube:10.7.0-community0842dcd4c8f8
hazelcast@5.4.0
5.7.0
1
library/sonarqube:6.7.6-community0ae5169e3d0f
hazelcast@3.8.6
5.7.0
1
library/sonarqube:9.1.0-datacenter-search7e43ff493a47
hazelcast@4.2
5.7.0
1
library/sonarqube:8.9.2-community88cd63154d4b
hazelcast@4.2
5.7.0
1
library/sonarqube:8.2-communitya246bc64207e
hazelcast@3.12.3
5.7.0
1
library/sonarqube:9.1.0-datacenter-appa9bc5a3a1fc3
hazelcast@4.2
5.7.0
1
library/sonarqube:8.9-communityeb2f0be32efd
hazelcast@4.2
5.7.0
1
library/sonarqube:10.0.0-communityef9723cf4fe4
hazelcast@5.2.1
5.7.0
1
massimolauri/wso2is:5.11.0-centose08abf0ce767
hazelcast@3.12.2.wso2v1
5.7.0
1
payara/micro:7.2026.2-jdk25fb44b8ce1cb2
hazelcast@5.3.8-payara-1
5.7.0
1
payara/server-full:7.2026.2-jdk2531f1253f0cf8
hazelcast@5.3.8-payara-1
5.7.0
1
sonatype/nexus3:3.53.04bd975493104
hazelcast@3.12.13
5.7.0
1
sonatype/nexus3:3.58.1586060431b64
hazelcast@3.12.13
5.7.0
1
wso2/wso2ei-analytics-dashboard:6.6.0526a1ccae902
hazelcast@3.12.2.wso2v1
5.7.0
1
wso2/wso2ei-analytics-worker:6.6.021e6b03449ac
hazelcast@3.12.2.wso2v1
5.7.0
1
wso2/wso2ei-integrator:6.6.0790cd8c3a5a2
hazelcast@3.12.2.wso2v1
5.7.0
1
xeotek/kadeck:6.3.439a3b37a17c5
hazelcast@5.3.5
5.7.0
1
xeotek/kadeck:4.2.94c6b04d9ce55
hazelcast@5.1.3
5.7.0
1
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
hazelcast@5.3.6
5.7.0
1
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
hazelcast@5.5.0
5.7.0
1
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
hazelcast@5.5.0
5.7.0
1
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
hazelcast@5.5.0
5.7.0
1
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
hazelcast@5.5.0
5.7.0
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
hazelcast@3.10.3
5.7.0
1
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
hazelcast@5.2.5
5.7.0
1

syft 1.42.1 · advisories as of 18 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.