CVE-2026-2254: Pentaho Auth Bypass Vulnerability

CVE-2026-2254 Overview

CVE-2026-2254 affects Hitachi Vantara Pentaho Data Integration & Analytics. The product fails to apply Access Control Lists (ACLs) on certain API endpoints related to platform mail notifications. This is an Incorrect Permission Assignment for Critical Resource issue [CWE-732]. An authenticated attacker with low privileges can reach functionality that should be restricted, affecting confidentiality, integrity, and availability of the mail notification subsystem.

Critical Impact

Authenticated users with limited privileges can access mail notification API endpoints that lack proper authorization checks, enabling unauthorized read or modification of notification configuration.

Affected Products

• Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6
• Hitachi Vantara Pentaho Data Integration & Analytics 11.0.0.0
• Hitachi Vantara Pentaho Data Integration & Analytics 9.3.x and 8.3.x branches

Discovery Timeline

• 2026-05-27 - CVE CVE-2026-2254 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-2254

Vulnerability Analysis

The vulnerability resides in API endpoints that manage platform mail notifications within Pentaho Data Integration & Analytics. These endpoints do not enforce ACL checks before processing requests. Any authenticated user with network access to the application can invoke them, regardless of role. The flaw is categorized as Broken Access Control and maps to [CWE-732] Incorrect Permission Assignment for Critical Resource.

Mail notification configuration in an analytics platform often references SMTP servers, distribution lists, and templated content. Exposure of these endpoints can leak operational details, allow tampering with notification flows, or disrupt scheduled job alerts. Because the platform integrates with data pipelines, modified notifications can suppress evidence of failed or malicious jobs.

Root Cause

The root cause is missing authorization enforcement on specific mail notification API endpoints. The application authenticates the session but does not verify that the calling principal holds the required permission for the requested operation. This is a classic Broken Access Control pattern where authentication is conflated with authorization.

Attack Vector

Exploitation requires network reachability to the Pentaho application and valid credentials with low privileges. No user interaction is needed. An attacker authenticates with a standard account, then issues HTTP requests directly to the unprotected mail notification endpoints. The attacker can read or modify notification settings that should be limited to administrators.

No verified public proof-of-concept code is available. Refer to the Pentaho Security Advisory CVE-2026-2254 for vendor technical details.

Detection Methods for CVE-2026-2254

Indicators of Compromise

• Unexpected HTTP requests from low-privileged user sessions to mail notification API paths in Pentaho application logs.
• Modifications to SMTP server configuration, recipient lists, or notification templates outside change-management windows.
• Sudden absence of expected job-failure notification emails, indicating possible suppression.

Detection Strategies

• Audit Pentaho application access logs for non-administrative accounts invoking notification configuration endpoints.
• Correlate authentication events with mail notification configuration changes to identify unauthorized actors.
• Compare current mail notification configuration against a known-good baseline on a recurring schedule.

Monitoring Recommendations

• Forward Pentaho web server and application logs to a centralized logging platform for retention and search.
• Alert on any HTTP 200 responses to notification API endpoints originating from accounts without administrator roles.
• Monitor outbound SMTP traffic from Pentaho hosts for unexpected destination servers or recipient domains.

How to Mitigate CVE-2026-2254

Immediate Actions Required

• Upgrade Pentaho Data Integration & Analytics to version 10.2.0.6 or later, or apply the fixed release for the 11.0.0.0 branch as published by Hitachi Vantara.
• Inventory all Pentaho deployments, including legacy 9.3.x and 8.3.x installations, and prioritize patching of internet-exposed instances.
• Review user accounts and remove unnecessary low-privileged access to reduce the population that can reach the vulnerable endpoints.

Patch Information

Hitachi Vantara has resolved the issue in Pentaho Data Integration & Analytics 10.2.0.6 and the corresponding fix for the 11.0.0.0 branch. Customers on 9.3.x and 8.3.x should consult vendor guidance for available remediation. Full advisory and download details are in the Pentaho Security Advisory CVE-2026-2254.

Workarounds

• Restrict network access to the Pentaho administrative interface using firewall rules or a reverse proxy that enforces source IP allow-listing.
• Place the application behind an authenticating gateway that applies additional role-based authorization on notification API paths.
• Disable or limit non-essential user accounts until the patch can be deployed across all environments.

# Configuration example: restrict access to Pentaho notification API at reverse proxy
location ~* /pentaho/api/.*mail.* {
    allow 10.0.0.0/24;     # admin subnet
    deny  all;
    proxy_pass http://pentaho-backend;
}