EUVD-2025-32658Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege team member
-
ExploitBrowse teammate's jobs on Hub < 1.16.0
-
ExecutionView full job input/output data
-
ImpactHarvest sensitive information beyond authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be an authenticated, low-privilege member of the same KNIME Business Hub team (PR:L), and the affected Hub must be running a version prior to 1.16.0. The disclosure is further gated by the situational requirement (AT:P) that a teammate's job actually contains sensitive input or output data - if jobs hold no sensitive data, there is nothing to leak. Limiting factors: no external or anonymous access is possible, the attacker cannot cross team boundaries, and upgrading to 1.16.0 (which restricts non-creators to job metadata only) fully remediates the issue. |
| Impact | This is a genuinely low-priority issue and the signals agree. The CVSS 4.0 base score is only 2.3, driven by a limited confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N), and critically requires an attacker to already hold legitimate low-privilege team credentials (PR:L) plus a situational attack requirement (AT:P) - namely that a teammate actually created a job containing sensitive in/output data. EPSS reinforces this: 0.04% probability at the 10th percentile indicates negligible expected exploitation. There is no CISA KEV listing and no public exploit identified, so this is not actively exploited. The flaw is an information-disclosure/incorrect-authorization issue (CWE-863), not a remote code path. One data caveat: the input Tags label this 'Authentication Bypass', which conflicts with both CWE-863 (Incorrect Authorization) and the description - no authentication is bypassed; rather, an already-authenticated team member sees data beyond their authorization scope. Treat this as a routine patch-on-schedule hygiene item, not an urgent priority. |
| Exploit ScenarioDerived | An authenticated member of a KNIME Business Hub team browses the jobs belonging to a teammate on a Hub running a version prior to 1.16.0 and views the full job detail, including input and output data that may contain sensitive or confidential information intended only for the job creator. No public exploit code is required - the disclosure occurs through normal UI/API access available to any team member. The exposure only yields value when a teammate's job actually contains sensitive data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 12, 2026
KNIME Business Hub deployments running versions prior to 1.16.0 expose the full contents of teammates' jobs - including any sensitive input and output data - to every member of the same team, because job-level authorization was not scoped to the job's creator. The weakness is an incorrect-authorization flaw (CWE-863) that requires an authenticated, low-privilege team member (PR:L) and is further gated by the situational condition that a teammate's job actually contains sensitive data; impact is limited to confidentiality with no integrity or availability effect (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and EPSS is 0.04% (10th percentile), so this is a low-priority, insider-adjacent information-disclosure issue that is fully remediated by upgrading to 1.16.0.
Earlier versions of this analysis (1)
RemediationAI
Vendor-released patch: upgrade KNIME Business Hub to 1.16.0 or later, the first release that restricts non-creators to job metadata only and reserves full job detail, including in- and output data, to the job creator; this is the complete fix and requires no configuration change. See https://www.knime.com/security/advisories for the vendor advisory. Where upgrading cannot be done immediately, the effective compensating control is to tighten team boundaries on the Hub: audit team memberships and remove or separate accounts that do not need to co-own the affected jobs, since a job is only exposed to users who share a team with its creator (the trade-off is reduced collaboration and more team sprawl). Additionally, avoid placing sensitive credentials or regulated data into job input parameters or output datasets until the upgrade is in place - this limits what can leak but degrades workflow usefulness because such values must then be supplied or handled outside the Hub. There is no indication that network-level filtering or port blocking helps here, because the attacker is an authenticated teammate using normal Hub interfaces, and this issue is not confirmed as actively exploited (no CISA KEV entry) so standard patch-cycle prioritization is appropriate.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
KNIME Business Hub is the enterprise orchestration platform on which KNIME workflows are deployed and executed as jobs, and those jobs can carry sensitive input parameters, intermediate data, and output datasets. The defect is classified as CWE-863, Incorrect Authorization: instead of enforcing a per-object authorization check that matched the requesting principal against the job's creator, the pre-1.16.0 job view relied on team-level membership as the effective access boundary, so any authenticated user sharing a team with the job owner inherited read access to the job's full detail. The affected component is identified by the wildcard CPE cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*, with EUVD enumerating the vulnerable range as KNIME Business Hub 0 through versions below 1.16.0. Exploitation is bounded in three ways consistent with the assessed vector: it is remote but requires network access to the Hub (AV:N), the attacker must already hold a valid low-privileged account on the same team (PR:L), and the CVSS 4.0 AT:P situational metric reflects that the leak only matters if a teammate's job actually holds sensitive content - if jobs carry no sensitive in- or output data, there is nothing to disclose. No external, anonymous, or cross-team access path is present, and starting with 1.16.0 non-creators are shown job metadata only.
Know when Business Hub gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green
Authenticated team member accesses data over the network (AV:N/PR:L); only limited confidentiality is affected (C:L) with no integrity or availability impact and no scope change.
Primary rating from Vendor (knime).
CVSS VectorVendor: knime
Lifecycle Timeline
4DescriptionCVE.org
Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present).
Executive ViewAI
Organizations using jobs on KNIME Business Hub should be aware of moderate risk from CVE-2025-11239, a incorrect authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Business Hub
View allA hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones lis
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. Rate
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. Rated medium severity (
Open redirect in KNIME Business Hub versions before 1.16.0 lets unauthenticated remote attackers craft links that point
A security vulnerability in KNIME Business Hub (CVSS 4.3). Remediation should follow standard vulnerability management p
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulner
GitHub PoC
Exploit-DB