KNIME Business Hub CVE-2026-115496

Exploitation requires an authenticated session to KNIME Business Hub (the description states an 'authenticated remote attacker') and prior knowledge of a target workflow's ID ('if their ID is known') - the attacker must already possess or guess a valid internal workflow identifier. The disclosure occurs through the catalog functionality's error messages. The flaw affects all versions prior to 1.18.5, and the vendor states a workaround is not possible, so upgrading to 1.18.5 is the only remediation. Limiting factors: valid credentials are needed, impact is confined to learning workflow names (no integrity/availability effect), and the attacker must know or enumerate the workflow ID. Note the input CVSS vector's PR:N contradicts the description's authentication requirement.

This is a low-impact information disclosure issue (CWE-209) that should be treated as routine patching rather than an emergency. The input CVSS 4.0 vector (score 6.9, medium) describes a network-reachable, low-complexity attack with no privileges or user interaction (PR:N/UI:N) and only low confidentiality impact (VC:L), with no integrity or availability impact. However, this conflicts with the description, which explicitly states an 'authenticated remote attacker' - so the PR:N in the vector appears inaccurate and the real precondition is a valid authenticated session, which meaningfully narrows the exploit population. No EPSS score, KEV listing, or PoC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the vuln.today decision label is 'this_month', consistent with a non-urgent, schedule-driven fix. The practical harm is bounded: an attacker who already holds valid credentials and knows a workflow's internal ID can learn that workflow's name - a minor confidentiality leak useful mainly for reconnaissance, not a path to code execution or data theft. Net: a genuine but low-priority issue; the medium CVSS slightly overstates real-world risk given authentication is required and impact is limited to metadata disclosure.

An authenticated user of KNIME Business Hub (for example, a low-privilege tenant member) submits catalog requests referencing workflow IDs they are not authorized to view and reads the overly informative error responses to recover the corresponding workflow names. The trigger mechanism beyond 'overly informative error messages' is not described in the available sources. No public exploit code or PoC reference was provided.