CVE-2026-2255
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0 (including 9.3.x and 8.3.x) expose Hadoop cluster credentials in plain text through the Cluster Test API. Users can leverage these credentials to submit jobs via the backend API.
Risk Assessment
Exposure of Hadoop credentials can lead to unauthorized access to cluster data and resources. An attacker with API access can execute jobs under the same account.
Recommendation
Update the software to version 10.2.0.6 or 11.0.0.0, and restrict access to the Cluster Test API and backend API.
Other vulnerabilities in Hitachi Vantara Pentaho
See all- CVE-2026-2254Medium
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, do not apply ACLs on certain API endpoints related to platform mail notifications.
- CVE-2026-2253High
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
Original NVD description (English source)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.