Pentaho Data Integration CVE-2026-2255

Exploitation requires an authenticated Pentaho session with at least low-privilege access (PR:L per CVSS vector) sufficient to reach the Cluster Test API - the same access level that permits Hadoop job submission via the backend API. The Hadoop cluster credentials are only exposed if Hadoop cluster definitions have been configured within the Pentaho platform; deployments with no configured Hadoop clusters are not affected by this specific disclosure. Network access to the Pentaho application layer is required (AV:N). Limiting factors include: the attacker must hold a valid Pentaho account, the target environment must have Hadoop clusters configured, and the incremental damage is bounded by the vendor's observation that the same user can already submit Hadoop jobs under those credentials through the standard backend API - meaning the credential exposure primarily enables out-of-band cluster access rather than new in-platform privilege escalation.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L) attack requiring low-privilege authentication (PR:L) with no user interaction (UI:N), limited confidentiality impact (C:L), and no integrity or availability impact. This scoring is internally consistent with the described behavior. EPSS of 0.03% at the 7th percentile signals extremely low observed or modeled exploitation activity, aligning with the absence of CISA KEV listing and the absence of public exploit code. The vendor's own mitigation note - that exploiting users already possess sufficient access to submit Hadoop jobs under the same account - materially reduces real-world incremental risk: an attacker who can reach the Cluster Test API is already a credentialed platform user with overlapping access to the underlying data resources. The primary residual risk is credential harvesting: plaintext credentials can be exfiltrated, stored, shared, or reused outside the Pentaho platform context (e.g., direct HDFS/YARN access, lateral movement to other Hadoop-adjacent systems). Overall, this is a low-urgency patching target unless the environment enforces strict least-privilege segmentation between Pentaho users and direct Hadoop cluster access.

An authenticated Pentaho platform user - for example, a data engineer or analyst with job-submission privileges - calls the Cluster Test API endpoint to retrieve diagnostic information about a configured Hadoop cluster. The API response includes the cluster's plaintext credentials, which the user captures and uses outside the Pentaho platform to authenticate directly to HDFS, YARN, or associated Hadoop services, bypassing Pentaho's audit logging and access controls. No public proof-of-concept code has been identified; the attack requires only standard HTTP tooling and valid Pentaho credentials.