CVE-2026-2255

Published: May 27, 2026Modified: Jul 24, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security.vulnerabilities@hitachivantara.com (Secondary)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.

Affected (4)

Products: Hitachi: Vantara Pentaho Data Integration And Analytics

Hitachi

1 product

Vantara Pentaho Data Integration And Analytics

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho Data Integration And Analytics	Before 10.2.0.7
Hitachi Vantara Pentaho Data Integration And Analytics	After 10.2.0.8 to 11.0.0.0
Hitachi Vantara Pentaho Data Integration And Analytics	Version 8.3
Hitachi Vantara Pentaho Data Integration And Analytics	Version 9.3

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (1)

https://support.pentaho.com/hc/en-us/articles/45672235545101--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-6-and-11-0-0-0-Impacted-CVE-2026-2255

Source: security.vulnerabilities@hitachivantara.com

Vendor Advisory

Timeline

No history available yet.