KNIME Business Hub CVE-2026-115517

Exploitation requires an authenticated KNIME Business Hub user (PR:L) AND two environment-specific prerequisites explicitly stated by the vendor: (1) the attacker must know the IP address of a target executor in a different execution context, and (2) that executor must have one or more open network ports that provide access without further authentication. By default no network ports are open on executors, so a default installation presents no attack surface - ports are opened only by specific running workflows, meaning exploitability is entirely contingent on which workflows are deployed. This conditionality, plus the required authenticated access, significantly limits realistic risk. The vendor notes network policies can be created manually as a workaround, and the issue is fixed in version 1.19.0.

This is a moderate-severity isolation flaw (CWE-653) scored 6.4 via CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N) with no vulnerable-system impact (VC:N/VI:N/VA:N) but subsequent-system impact of SC:L/SI:H/SA:H - meaning the real harm lands on OTHER execution contexts' executors, not the attacker's own context. The vector implies an authenticated remote user (PR:L), so this is not an unauthenticated internet-facing bug. No EPSS score, KEV listing, or POC was provided in the input, and the vendor (KNIME) is the sole reporter; the only reference is the KNIME security advisories index, not a specific exploit or detailed write-up. The vuln.today priority is 'this_month' rather than act_now/emergency, consistent with a real-but-not-urgent issue. Crucially, the description itself heavily qualifies exploitability: it is 'only a security issue if the IP address of the attacked executor is known and there are open network ports that provide access without further authentication,' and 'by default no network ports are open.' This makes the practical risk strongly environment-dependent - a tenant-isolation weakness that only matters when deployed workflows happen to open unauthenticated ports. The CVSS AC:L/AT:N understates this conditionality; the input evidence makes clear exploitation is gated on non-default, workflow-specific port exposure, so I assess the real-world complexity as higher than the headline vector suggests. Priority: treat as a scheduled patch for multi-tenant KNIME Business Hub operators, not a fire-drill.

An authenticated KNIME Business Hub user in one execution context determines the IP address of an executor belonging to a different execution context and connects directly to a network port that a running workflow has opened, bypassing the intended isolation between contexts. Because such ports (when present) provide access without further authentication, the attacker can interact with the neighbouring tenant's exposed service. The attack is only viable when a workflow in the target context has opened a port, since none are open by default; no public exploit code was identified in the provided data.