CVE-2021-31602: Pentaho default Spring security config allows unauthenticated information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication or interaction required, and public exploit material, though no KEV listing or confirmed in-the-wild activity.

What it is

Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x ship a default applicationContext-spring-security.xml configuration whose applicationContext security layer permits unauthenticated access. An attacker with no prior knowledge of the platform can extract pieces of information without valid credentials. The flaw is an authentication weakness in a widely deployed BI platform, exposing data to anyone who can reach the service.

Impact

An unauthenticated attacker gains read access to information the security model was meant to protect, with high confidentiality impact and no integrity or availability effect. The extracted data can support further reconnaissance or lateral targeting of the Pentaho deployment.

Attack surface

Reachable over the network via HTTP against the Pentaho web application; the CVSS vector shows PR:N and UI:N, so no authentication and no user interaction are required. The description confirms an unauthenticated user with no prior platform knowledge can trigger it.

Exploitation

Not listed in CISA KEV, but EPSS is 0.51653 (98.9th percentile) and references include an Exploit-tagged Packet Storm advisory, indicating public exploit material exists. No ransomware association is documented.

What to do

• Apply the vendor fix or upgrade to a Pentaho release where the default applicationContext-spring-security.xml configuration is corrected; check Hitachi Vantara security advisories for the supported version.
• If immediate patching is not possible, restrict network access to the Pentaho server to trusted networks or place it behind an authenticating reverse proxy.
• Review and harden the applicationContext security layer so unauthenticated requests cannot reach protected resources.
• Audit the deployment for exposed default configurations and remove or disable unnecessary endpoints.
• Monitor vendor advisories for updated guidance on affected versions.

Detection

• Review Pentaho web server and application logs for unauthenticated requests to protected applicationContext endpoints returning data.
• Baseline normal authenticated traffic and alert on successful responses to requests lacking session or authentication tokens.
• Hunt for access to Pentaho management or configuration paths from unexpected source IPs.
• Correlate Packet Storm exploit signatures or known PoC request patterns against web logs and IDS/IPS alerts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.