CVE-2026-2255

Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials

State: Published
Severity: 4.3 Medium
Published: May 27, 2026
Updated: May 27, 2026
Reserved: Feb 9, 2026

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	HITVAN

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
Pentaho Data Integration and AnalyticsHitachi Vantara	1.0 to before 10.2.0.6Affected 10.0 to before 11.0.0Affected

References

https://support.pentaho.com/hc/en-us/articles/45672235545101--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-6-and-11-0-0-0-Impacted-CVE-2026-2255

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.