PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2255 Hitachi Vantara CVE debrief

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. The vendor notes that while users should not see these credentials explicitly, the defect's impact is mitigated because authenticated users can already leverage those same credentials to submit jobs under the same account through the backend API. The vulnerability is classified as CWE-522 (Insufficiently Protected Credentials).

Vendor
Hitachi Vantara
Product
Pentaho Data Integration and Analytics
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-07-23
Advisory published
2026-05-27
Advisory updated
2026-07-23

Who should care

Organizations running Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.6 or 11.0.0.0, particularly those with Hadoop cluster integrations. Security teams should prioritize patching environments where multiple users have authenticated access to the Pentaho platform and Hadoop job submission capabilities.

Technical summary

The Cluster Test API in affected Pentaho versions returns Hadoop cluster credentials in plain text. This is an instance of CWE-522 (Insufficiently Protected Credentials). The attack vector is network-based, requires low attack complexity, and requires authenticated access (PR:L). The confidentiality impact is low as the exposed credentials are already usable by the authenticated user through legitimate backend API functions. No integrity or availability impact is assigned.

Defensive priority

medium

Recommended defensive actions

  • Upgrade to Hitachi Vantara Pentaho Data Integration & Analytics version 10.2.0.6 or 11.0.0.0 or later
  • Review access controls to the Cluster Test API to ensure least-privilege access
  • Audit Hadoop cluster credential usage and rotate credentials if unauthorized access is suspected
  • Monitor for anomalous job submissions in affected Hadoop environments
  • Review vendor security advisory for additional configuration guidance

Evidence notes

The vulnerability description and affected versions are sourced from the official CVE record and NVD entry. The vendor advisory confirms the issue affects Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) supports the MEDIUM severity rating.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-2255 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-2255

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-2255 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2255

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://support.pentaho.com/hc/en-us/articles/45672235545101--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-6-and-11-0-0-0-Impacted-CVE-2026-2255

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.