CVE-2026-2255

Katalog CVE

CVSS 4.3 · Medium EPSS 0,17%

Kerentanan Insufficiently Protected Credentials pada hitachi vantara pentaho data integration and analytics. Skor CVSS 3.1 4.3 (Medium) menurut hitachivantara.com.

Deskripsi (NVD)

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber hitachivantara.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.pentaho.com/hc/en-us/articles/45672235545101--Resolved-Hitachi-Vantara-Pentaho-Data-Integratio... advisory vendor