PatchTheCVECVE-2026-2255: Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x an
CVE-2026-2255 is a medium-severity flaw (CVSS 4.3) affecting vantara pentaho data integration and analytics. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 94%) |
| CISA exploited list | No |
| Weakness | CWE-522 |
| Published | 2026-05-27 |
| Last modified | 2026-07-24 |
Last updated 2026-07-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-2255?
vantara pentaho data integration and analytics: upgrade to 10.2.0.7, 11.0.0.0. Exact commands for each OS are on this page.
Is CVE-2026-2255 being exploited?
CVE-2026-2255 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-2255 affect?
CVE-2026-2255 affects vantara pentaho data integration and analytics. Severity is medium (CVSS 4.3). Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those expl
How urgent is CVE-2026-2255?
Priority 16/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2025-11159 CRITICAL 9.1 UPGRADE Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases wh
- CVE-2026-2253 HIGH 7.7 UPGRADE Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x an
- CVE-2026-2254 MEDIUM 6.3 UPGRADE Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x an