CVE-2026-2255: Pentaho Credential Exposure Vulnerability

CVE-2026-2255 Overview

CVE-2026-2255 affects Hitachi Vantara Pentaho Data Integration & Analytics. The product exposes Hadoop cluster credentials in plain text through the Cluster Test API. Affected releases include versions before 10.2.0.6 and 11.0.0.0, including the 9.3.x and 8.3.x branches.

The weakness maps to CWE-522: Insufficiently Protected Credentials. An authenticated user with low privileges can read credentials that should remain hidden. The impact is reduced because the same user can already submit jobs through the backend API under that account.

Critical Impact
Authenticated users can retrieve plain-text Hadoop cluster credentials through the Cluster Test API, enabling credential reuse outside the Pentaho application context.

Affected Products

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6
Hitachi Vantara Pentaho Data Integration & Analytics versions before 11.0.0.0
Hitachi Vantara Pentaho Data Integration & Analytics 9.3.x and 8.3.x branches

Discovery Timeline

2026-05-27 - CVE-2026-2255 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-2255

Vulnerability Analysis

The Cluster Test API in Pentaho Data Integration & Analytics returns Hadoop cluster credentials in clear text. The API was designed to validate connectivity to configured Hadoop clusters. During the test response, the application includes the stored credential material instead of masking or redacting it.

An attacker with authenticated low-privilege access can issue a request to the Cluster Test endpoint. The response discloses the username and password tied to the cluster configuration. The disclosed credentials can then be reused outside the Pentaho application boundary, including direct access to the Hadoop cluster from other tools or networks.

The vendor notes that the same authenticated user can already submit jobs under that account through the backend API. This limits the privilege gap but does not remove the risk of credential reuse, lateral movement, or credential leakage outside the application.

Root Cause

The root cause is CWE-522: Insufficiently Protected Credentials. The Cluster Test API does not mask, redact, or omit sensitive credential fields before returning the response payload to the client. Stored Hadoop credentials are surfaced verbatim to any authenticated session permitted to invoke the test.

Attack Vector

Exploitation requires network access to the Pentaho web interface and valid low-privilege authentication. The attacker invokes the Cluster Test API against a configured Hadoop cluster entry and parses the returned credential fields. No user interaction is required. The disclosed credentials enable downstream access to the Hadoop cluster outside the Pentaho session context.

No public proof-of-concept code is available for this issue. See the Pentaho Security Advisory CVE-2026-2255 for vendor-provided technical detail.

Detection Methods for CVE-2026-2255

Indicators of Compromise

Unexpected authenticated requests to the Pentaho Cluster Test API endpoint, especially from low-privilege accounts.
Outbound connections to Hadoop cluster nodes originating from hosts that previously had no direct Hadoop access.
Successful Hadoop authentication events using service credentials from non-Pentaho source addresses.

Detection Strategies

Enable verbose access logging on the Pentaho server and alert on Cluster Test API invocations grouped by user identity.
Correlate Pentaho audit logs with Hadoop authentication logs to detect reuse of cluster credentials outside expected job-execution paths.
Baseline normal Cluster Test API usage by administrators and flag deviations by lower-privileged user accounts.

Monitoring Recommendations

Forward Pentaho application logs and Hadoop authentication logs into a central SIEM for cross-source correlation.
Monitor for high-frequency or scripted access patterns against the Cluster Test endpoint.
Track new or unusual user-agent strings and source IPs interacting with Pentaho administrative APIs.

How to Mitigate CVE-2026-2255

Immediate Actions Required

Upgrade Pentaho Data Integration & Analytics to version 10.2.0.6 or 11.0.0.0 or later as published by Hitachi Vantara.
Rotate all Hadoop cluster credentials configured within Pentaho on affected versions before and after patching.
Review user accounts with access to Pentaho and remove unnecessary low-privilege accounts that can reach the Cluster Test API.

Patch Information

Hitachi Vantara has released fixed builds in versions 10.2.0.6 and 11.0.0.0. Customers on the 9.3.x and 8.3.x branches must upgrade to a fixed release. Refer to the Pentaho Security Advisory CVE-2026-2255 for upgrade guidance and supported paths.

Workarounds

Restrict network access to the Pentaho administrative interface using firewall or reverse-proxy controls until patches are applied.
Limit Cluster Test API usage to dedicated administrator accounts through role-based access controls.
Use distinct Hadoop service accounts per environment with least-privilege rights to reduce blast radius if credentials are disclosed.

bash

# Configuration example: restrict access to the Pentaho admin interface at the reverse proxy
# Example nginx allowlist for the Pentaho management endpoints
location /pentaho/ {
    allow 10.0.0.0/24;   # administrator subnet
    deny  all;
    proxy_pass http://pentaho-backend;
}