Insufficiently Protected Credentials in Hitachi Vantara Pentaho Data Integration & Analytics

CVE-2026-2255

What is CVE-2026-2255?

The Hitachi Vantara Pentaho Data Integration and Analytics platforms prior to version 10.2.0.6 and 11.0.0.0 are susceptible to a significant security flaw that leaves Hadoop cluster credentials exposed in plaintext via the Cluster Test API. Although the credentials are not intended to be visible to users, the inherent risk is amplified as an attacker with access to the backend API can utilize these credentials to submit jobs, thereby compromising the security of the entire system. This vulnerability necessitates immediate action to mitigate potential exploitation.

References