This vulnerability (CVE-2026-2255) affects Hitachi Vantara Pentaho Data Integration and Analytics products prior to versions 10.2.0.6 and 11.0.0.0. It exposes Hadoop cluster credentials in plaintext through the Cluster Test API. The exposure is considered insufficiently protected credentials (CWE-522). The defect is mitigated by the fact that users able to access the API can already perform actions using those credentials via the backend API, limiting the additional risk of credential exposure. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows users with some level of access (PR:L) to view Hadoop cluster credentials in plaintext, potentially increasing the risk of credential compromise. However, since those users can already submit jobs under the same account through the backend API, the incremental impact is limited to confidentiality loss without integrity or availability impact. There are no known exploits in the wild at this time.

No official patch or remediation level has been provided by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should review access controls to limit who can invoke the Cluster Test API and monitor usage for suspicious activity related to credential exposure.