Pentaho Data Integration CVE-2026-2254

Exploitation requires a valid authenticated session with at minimum low-privilege credentials (PR:L per CVSS vector) - unauthenticated exploitation is not indicated by available data. Network access to the Pentaho server is required (AV:N). The platform mail notification feature must be present and configured, as the vulnerable endpoints are specific to that subsystem. No user interaction from a victim is required (UI:N). The primary limiting factors are: (1) the need for at least one valid account credential, which prevents anonymous exploitation; (2) scope is restricted to the mail notification API surface rather than the full platform; and (3) the overall impact per the CVSS is limited (no complete compromise of any CIA dimension), suggesting the mail notification resource does not contain highly sensitive data or grant privilege escalation paths based on available data.

CVSS 6.3 (Medium) reflects a network-reachable, low-complexity attack requiring low-privilege authentication with no user interaction, producing limited impact across all three CIA dimensions (C:L/I:L/A:L, S:U). The EPSS score of 0.03% at the 10th percentile strongly suggests this vulnerability has not attracted meaningful attacker interest and is unlikely to be opportunistically exploited at scale. There is no CISA KEV listing and no known public proof-of-concept. The combination of these signals places this firmly in the low-urgency tier despite a moderate CVSS score. The primary real-world risk is an insider threat or a compromised low-privilege account abusing mail notification configuration - plausible in environments where Pentaho is internet-exposed or where internal user trust is not tightly controlled. The PR:L requirement is a meaningful limiting factor: unauthenticated exploitation is not supported by the available data.

An attacker with a valid low-privilege Pentaho account - obtained through credential stuffing, phishing, or reuse from another system - sends crafted HTTP requests directly to the unprotected mail notification API endpoints over the network. Because no ACL check is enforced, the server processes the request and returns or modifies mail notification configuration data that should be restricted to administrative roles. No public proof-of-concept exists, but the straightforward nature of missing access control means exploitation requires no specialized tooling.