CVE-2026-2254: Hitachi Vantara Pentaho Data Integration And Analytics

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.

Affected products

• Hitachi Vantara Pentaho Data Integration And Analytics: before 10.2.0.7 (fixed in 10.2.0.7); after 10.2.0.8, before 11.0.0.0 (fixed in 11.0.0.0); version 8.3 only; version 9.3 only

Published 2026-05-27. Last modified 2026-07-24.