PT-2026-43485 · Hitachi Vantara · Pentaho Data Integration & Analytics

Dan Begey · Published 2026-05-27 · Updated 2026-06-18 · CVE-2026-2255

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.6 Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 11.0.0.0

Description Hadoop cluster credentials are exposed in plain text through the 'Cluster Test API'. While these credentials are not intended to be explicitly visible to the user, they can be leveraged to submit jobs under the same account via the backend API.

Recommendations Update to version 10.2.0.6 or later. Update to version 11.0.0.0 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2026-08641

CVE-2026-2255

Affected Products

Pentaho Data Integration & Analytics

References · 7

• https://bdu.fstec.ru/vul/2026-08641 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2255 · Security Note
• https://support.pentaho.com/hc/en-us/articles/45672235545101--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-6-and-11-0-0-0-Impacted-CVE-2026-2255 · Vendor Advisory
• https://t.me/cveNotify/164792 · Telegram Post
• https://t.me/CVEtracker/55069 · Telegram Post
• https://support.pentaho.com/hc/en-us/articles/45676384909069--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-6-and-11-0-0-0-Impacted-CVE-2026-2254?brand_id=1928686 · Note
• https://t.me/cveNotify/170562 · Telegram Post