KNIME Business Hub CVE-2026-115454

Requires an authenticated account with access to the remote workflow editing capability of KNIME Business Hub (CVSS PR:L / AU:Y); no user interaction is needed and the request is network-reachable. Exploitation is limited to KNIME Business Hub instances prior to version 1.19.0. The limiting factor is the authentication requirement - an attacker must possess valid credentials with workflow-editing access. Impact is confined to intermittent availability of workflow execution; no data confidentiality or integrity is affected. The vendor states no workaround is possible, so upgrading to 1.19.0 is the only remediation.

This is a moderate, availability-only issue (CVSS 4.0 base 5.3, vendor-assigned by KNIME). The 4.0 vector is network-reachable with low attack complexity and no user interaction (AV:N/AC:L/AT:N/UI:N) but requires authentication (PR:L, AU:Y) and yields only limited availability impact (VA:L) with no confidentiality or integrity impact (VC:N/VI:N) and no scope change to other systems (SC/SI/SA:N). The R:A (automatable recovery) and U:Green values reinforce that impact is transient and self-recovering rather than destructive, matching the description's 'intermittent unavailability.' No EPSS score, KEV listing, or exploit/PoC reference is present in the input, so there is no signal of active exploitation or public exploit code. The vuln.today decision label is 'this_month,' i.e. a routine patch priority, not act_now/emergency. Net assessment: a genuine but low-urgency denial-of-service flaw whose real-world risk is bounded by the authentication requirement and the lack of any exploitation evidence; prioritize behind anything network-unauthenticated or with confidentiality/integrity impact.

An attacker who already holds a valid, low-privileged KNIME Business Hub account uses the remote workflow editing feature to issue requests that cause uncontrolled server-side resource allocation (CWE-770), exhausting server resources. This produces intermittent unavailability of workflow execution for other users. No public exploit code or PoC reference is identified in the available data.