Vulnerability feed

Executive summary

This advisory page from KNIME covers many security issues across KNIME Analytics Platform, KNIME Server, and KNIME Business Hub, including the newest entries published in October 2026 and many older ones. The most recent items include credential logging in KNIME Analytics Platform used as an executor (CVSS v4.0 4.8, Medium) and several Medium issues in KNIME Business Hub, which the vendor says are fixed in version 1.19.0. The vendor recommends updating to the fixed versions listed for each issue.

Technical summary

The advisory lists many issues with different classes, including credential logging, missing cookie attributes, missing authorization checks, CSRF protection bypass via a forged X-Forwarded-Host header, excessive resource allocation, open redirect, and cross-site scripting. For CVE-2026-115657, KNIME Analytics Platform before 5.8.4 and 5.12.0 logs configured proxy credentials at startup when used as an executor, and an attacker with access to log files could reuse them; the advisory says there is no risk without an authenticated proxy, and fixed versions are LTS 5.8.4 and 5.12.0. For the KNIME Business Hub items, the fixed version is 1.19.0 for most CVEs, with workarounds stated for some (such as network policies or removing links without login) and not possible for others. For CVE-2026-4649, the advisory states Apache Artemis is affected, the fix is in Business Hub 1.18.0, 1.17.4, 1.16.3, and 1.15.2, and no workaround is known. Where the advisory does not state a workaround or detection guidance, this is not stated. Detection guidance is not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Dropped extracted product not named in the source:

Summarized from knime.com/security/advisories

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

ApacheKNIMEApache TomcatKNIME Business HubKNIME Analytics PlatformKNIME ServerApache Artemis

Executive summary

This advisory concerns CVE-2026-115519 in KNIME Business Hub versions before 1.19.0. The advisory says missing security attributes on sensitive cookies could let an unauthenticated remote attacker compromise user sessions, but only when other security issues such as cross-site scripting or a man-in-the-middle attack are also present. The advisory rates it Low with a CVSS v4.0 score of 2.1, and recommends updating to version 1.19.0.

Technical summary

The weakness is missing 'Secure' and 'HttpOnly' attributes on sensitive cookies, which is a session protection weakness. The advisory states the attacker is unauthenticated and remote, and that exploitation requires other issues such as cross-site scripting or a man-in-the-middle position. Affected versions are listed as KNIME Business Hub before 1.19.0, and the fixed version is 1.19.0. The advisory states that no workaround is possible. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from knime.com/security/advisories

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

Present

Privileges required

High

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

KNIMEKNIME Business Hub

Executive summary

KNIME Business Hub versions before 1.19.0 let an authenticated user reach open network ports on executors in other execution contexts. The advisory rates the issue Medium, with a CVSS v4.0 score of 6.4. KNIME recommends updating to version 1.19.0, and the advisory notes that a manual network policy workaround exists.

Technical summary

The flaw is unrestricted network access between execution contexts, which is a network segmentation weakness. An authenticated remote user can reach open network ports on executors in different execution contexts, and the CVSS v4.0 vector is AV:N/AC:L/AT:N/PR:L/UI:N. The advisory says this is only a practical issue if the target executor's IP address is known and the open ports accept connections without further authentication. By default no network ports are open, but running workflows may open ports. The affected versions are KNIME Business Hub before 1.19.0, and the fixed version is 1.19.0. The advisory's workaround is to create network policies manually, and it does not state any detection guidance. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from knime.com/security/advisories

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

KNIMEKNIME Business Hub

Executive summary

KNIME Business Hub versions before 1.19.0 let anyone with a "link without login" for a DataApp see and possibly access jobs that other users created through the same link. The advisory rates the issue Medium, with a CVSS v4.0 score of 6.3. KNIME recommends updating to Business Hub 1.19.0 or later, or removing all links without login to DataApps as a temporary workaround.

Technical summary

The flaw is a missing authorization check, which is a broken access control issue, in the DataApp "link without login" feature. Anyone holding such a link can list and potentially access jobs of other users created by the same link. The CVSS v4.0 vector is AV:N/AC:H/AT:N/PR:N/UI:N with low confidentiality and integrity impact, so no account is needed but attack complexity is high. Affected versions are KNIME Business Hub before 1.19.0, and the fixed version is 1.19.0. The advisory's workaround is to remove all "links without login" to DataApps. The advisory does not state any detection guidance, whether exploitation has been observed in the wild, or any additional mitigations. The issue was reported by the security researcher Rock Jein.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from knime.com/security/advisories

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

KNIMEKNIME Business Hub

Executive summary

The advisory concerns KNIME Business Hub versions before 1.18.5, where overly detailed error messages in the catalog functionality can reveal workflow names. The vendor rates it Medium severity with a CVSS v4.0 score of 6.9, and recommends updating to KNIME Business Hub 1.18.5 or later.

Technical summary

The flaw is an information exposure caused by overly informative error messages in the catalog functionality of KNIME Business Hub prior to 1.18.5. An authenticated remote attacker can see workflow names if they know the workflow ID. The CVSS v4.0 score is 6.9 (Medium) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Affected version is listed as before 1.18.5 and the fixed version is 1.18.5 and later. The advisory states that no workaround is possible. Detection guidance and exploitation in the wild are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from knime.com/security/advisories

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

KNIMEKNIME Business Hub

Executive summary

A flaw in KNIME Business Hub before version 1.19.0 lets an authenticated attacker bypass the cross-site request forgery protection and change the state of resources when a user passively interacts with a malicious page. The advisory rates it Medium, with a CVSS v4.0 score of 5.3. The vendor recommends updating to KNIME Business Hub 1.19.0 or later.

Technical summary

The weakness is in the CSRF prevention of KNIME Business Hub, which can be tricked by a forged X-Forwarded-Host header, as the advisory title states. The attacker must be authenticated, and the attack needs passive user interaction, so the victim's resources can be changed without the user noticing. The CVSS v4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green, with a score of 5.3. Affected versions are KNIME Business Hub before 1.19.0, and the fixed version is 1.19.0. The advisory's workaround is for an API gateway or firewall in front of the product to remove the X-Forwaded-For header (spelled that way in the advisory) from all incoming requests. Detection guidance and any exploitation in the wild are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from knime.com/security/advisories

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

Passive

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

Affects

KNIMEKNIME Business Hub

Executive summary

KNIME Business Hub versions before 1.19.0 are affected by a flaw in which a logged-in user can exhaust server resources through large tables in data apps. This can cause intermittent outages of workflow execution. The advisory rates it Medium (CVSS v4.0 5.3) and recommends updating to KNIME Business Hub 1.19.0 or later.

Technical summary

The flaw is an excessive resource allocation issue (a resource exhaustion weakness) in KNIME Business Hub before 1.19.0, triggered by large tables in data apps. The CVSS v4.0 vector indicates a network attack that requires low privileges, meaning an authenticated user is needed, and it impacts availability only. The advisory states that exploitation leads to intermittent unavailability of workflow execution functionality. The fixed version is 1.19.0, and the advisory recommends updating to 1.19.0 or later. The advisory states that no workaround is possible. It does not state whether exploitation has been observed in the wild, and it gives no detection guidance or indicators of compromise.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from knime.com/security/advisories

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:Green

Affects

KNIMEKNIME Business Hub