CVE-2026-2253: Hitachi Pentaho XXE Vulnerability

CVE-2026-2253 Overview

CVE-2026-2253 is an XML External Entity (XXE) vulnerability affecting Hitachi Vantara Pentaho Data Integration & Analytics. The flaw exists because certain XML parsers in the product do not prevent the resolution of external entities. Affected versions include releases before 10.2.0.7 and 11.0.0.0, including the 9.3.x and 8.3.x branches. An authenticated attacker with low privileges can submit crafted XML to trigger external entity resolution, exposing data from systems the Pentaho server can reach. The issue is tracked under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact

Authenticated attackers can abuse XML parsing to read internal files, perform server-side request forgery, and access confidential information across trust boundaries.

Affected Products

• Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7
• Hitachi Vantara Pentaho Data Integration & Analytics versions before 11.0.0.0
• Pentaho 9.3.x and 8.3.x release branches

Discovery Timeline

• 2026-05-27 - CVE-2026-2253 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-2253

Vulnerability Analysis

The vulnerability stems from XML parsers within Pentaho Data Integration & Analytics that accept and resolve external entity references in XML documents. When the application processes XML input from a low-privileged authenticated user, the parser fetches external resources defined in document type declarations. This behavior allows an attacker to reference local files or remote URLs through entity definitions. The parser then includes that resolved content in the processed document. The result is information disclosure across a trust boundary, reflected in the scope-changed confidentiality impact of the issue.

Root Cause

The XML parsers used in affected Pentaho components are configured without disabling external entity processing and external DTD loading. Java XML parsing libraries resolve SYSTEM and PUBLIC identifiers by default unless features such as disallow-doctype-decl, external-general-entities, and external-parameter-entities are explicitly set. The affected code paths did not enforce these protections before parsing untrusted input, producing the [CWE-611] condition.

Attack Vector

An attacker authenticated to Pentaho with low privileges submits an XML payload to a vulnerable endpoint that performs server-side parsing. The payload defines an external entity that points to a local file path or an attacker-controlled URL. When the parser resolves the entity, it reads file contents or issues outbound requests on behalf of the server. The attacker retrieves the leaked content through the application response or out-of-band channels. Exploitation does not require user interaction and operates over the network.

No verified public proof-of-concept code is currently available. Refer to the Pentaho Support Advisory CVE-2026-2253 for vendor-provided technical context.

Detection Methods for CVE-2026-2253

Indicators of Compromise

• Inbound XML payloads to Pentaho endpoints containing <!DOCTYPE declarations with SYSTEM or PUBLIC external entity references.
• Outbound network connections from the Pentaho server to unexpected internal IP ranges or external hosts triggered by XML processing.
• Unexpected file read activity on the Pentaho server targeting sensitive paths such as /etc/passwd, configuration files, or credential stores.
• Authenticated user sessions submitting repeated malformed or unusually structured XML to data integration endpoints.

Detection Strategies

• Inspect HTTP request bodies sent to Pentaho services for XML containing ENTITY declarations that reference external resources.
• Correlate authenticated Pentaho user activity with outbound DNS or HTTP requests initiated by the Java process serving the application.
• Baseline normal XML parsing patterns in Pentaho and alert on deviations that include DTD declarations.

Monitoring Recommendations

• Enable verbose logging on the Pentaho application server and forward logs to a centralized analytics platform.
• Monitor process and network telemetry from the Pentaho host for unexpected file access and outbound connections during XML processing.
• Track user accounts that interact with XML-handling endpoints and review activity for low-privileged accounts exhibiting parsing-heavy behavior.

How to Mitigate CVE-2026-2253

Immediate Actions Required

• Upgrade Pentaho Data Integration & Analytics to version 10.2.0.7 or 11.0.0.0 or later, per the vendor advisory.
• Restrict network access to Pentaho administrative and data integration endpoints to trusted internal networks only.
• Audit existing Pentaho user accounts and revoke unnecessary low-privileged access that could be used to submit XML payloads.
• Review application and proxy logs for prior XML submissions containing external entity declarations.

Patch Information

Hitachi Vantara has resolved the vulnerability in Pentaho Data Integration & Analytics versions 10.2.0.7 and 11.0.0.0. Customers running 9.3.x or 8.3.x should follow the upgrade path described in the Pentaho Support Advisory CVE-2026-2253.

Workarounds

• Place a web application firewall in front of Pentaho and block requests whose bodies contain <!DOCTYPE or <!ENTITY declarations referencing external resources.
• Restrict egress network traffic from the Pentaho server to prevent out-of-band data exfiltration through resolved entities.
• Limit the privileges of the operating system account running the Pentaho process so that file reads are constrained to required directories.

# Example WAF rule fragment to block XML payloads with external entities
# (adapt to your WAF syntax before deployment)
SecRule REQUEST_BODY "@rx (?i)<!DOCTYPE[^>]+(SYSTEM|PUBLIC)" \
    "id:1002253,phase:2,deny,status:400,log,\
     msg:'Potential XXE payload targeting Pentaho (CVE-2026-2253)'"