CVE-2026-2255: Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 6% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PD

Pentaho Data Integration and Analytics · Hitachi Vantara

1.0 before 10.2.0.6; 10.0 before 11.0.0 · source: vendor

VP

Vantara Pentaho Data Integration And Analytics · Hitachi

before 10.2.0.7; after 10.2.0.8 before 11.0.0.0; 8.3; 9.3 · source: NVD