Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0 expose Hadoop cluster credentials in plain text through the Cluster Test API. The credentials are not directly displayed to the user, but the flaw allows an attacker to capture them and then use those same credentials to submit jobs under the same account via the backend API. This constitutes a credential disclosure vulnerability that can enable unauthorized job submission, potential data access, and misuse of computational resources.

The affected products are Hitachi Vantara Pentaho Data Integration and Analytics for versions 9.3.x, 8.3.x, and any release before 10.2.0.6 and 11.0.0.0. Users running these versions on Hadoop clusters should review the release notes and patch status.

The CVSS score of 4.3 indicates moderate severity, and the lack of an EPSS score means no publicly available data on exploitation rate; the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be the Cluster Test API endpoint, which is likely accessible to authenticated users in the system. The flaw does not require privileged access beyond normal application users, so the risk is moderate to high if the credentials are compromised.