KNIME Business Hub CVE-2026-115502

Exploitation requires that a DataApp in KNIME Business Hub has been configured with a 'link without login' and that this link is shared among multiple users who create jobs through it; the attacker must have access to that specific link. The flaw then lets any such link user list and potentially access jobs created by other users of the same link, because the authorization check between those users is missing. Limiting factors: the vulnerable state does not exist unless an operator deliberately creates and distributes a login-less link, exposure is scoped to jobs created through that same link rather than the entire Hub, and the vendor's documented workaround (removing all 'links without login' to DataApps) fully eliminates the condition; upgrading to 1.19.0 is the complete fix.

This is a medium-severity authorization flaw (vendor CVSS 4.0 base 6.3) whose real-world priority is moderate, not urgent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) indicates a network-reachable issue with no authentication (PR:N) and no user interaction, but low confidentiality and integrity impact and high attack complexity (AC:H), reflecting that exploitation depends on a specific precondition - the existence and sharing of a DataApp 'link without login.' There is no CISA KEV listing and no EPSS score in the supplied data, and the single reference is the KNIME vendor advisory, not a proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' which aligns with a patch-on-normal-cycle priority rather than an emergency. The signals are internally consistent: PR:N is technically accurate because the link bypasses login, but the practical gate is that an administrator must have deliberately created and distributed such a link, which bounds exposure. No EPSS or KEV data is available to independently corroborate exploitation likelihood - treat the low-impact, condition-dependent profile as the governing factor.

An organization publishes a KNIME DataApp via a 'link without login' and shares it with several users. A user (or anyone who obtains the link) who submits jobs through it discovers they can enumerate and potentially open jobs that other users created via the same link, exposing those users' job data. No public exploit code is identified; the issue is a missing authorization check that requires only normal interaction with the shared link.