CVE-2026-2255

MediumCVSS 4.3/10Last modified Jul 24, 2026

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-225508.8OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary CVE-2026-225516.5In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitraryCVE-2026-225529.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate dCVE-2026-225539.8All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious uCVE-2026-225547.8A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26.01). A specially crCVE-2026-225558.1Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, whiCVE-2026-2255710.0A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access fCVE-2026-225587.7An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access toCVE-2026-225598.8An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is sociaCVE-2026-22566.5A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary CVE-2026-225605.3An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameCVE-2026-225617.8Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privil