CVE-2026-2254
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, do not apply ACLs on certain API endpoints related to platform mail notifications.
Risk Assessment
Unauthenticated or unauthorized users may access email notification functions, potentially leading to information disclosure or unauthorized actions.
Recommendation
Update Hitachi Vantara Pentaho to version 10.2.0.6, 11.0.0.0, or later.
Other vulnerabilities in Hitachi Vantara Pentaho
See all- CVE-2026-2255Medium
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0 (including 9.3.x and 8.3.x) expose Hadoop cluster credentials in plain text through the Cluster Test API. Users can leverage these credentials to submit jobs via the backend API.
- CVE-2026-2253High
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
Original NVD description (English source)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.