KNIME Analytics Platform EUVD-2026-108631

Exploitation requires all of the following concrete conditions: KNIME Analytics Platform LTS before 5.8.4 must be deployed specifically as an executor within KNIME Server or KNIME Business Hub; proxy settings with credentials must have been configured (the credentials are only exposed because they are logged at startup); and the attacker must have read access to the executor's log files. Limiting factors that reduce realistic risk: access is local (AV:L) rather than remote, the attacker must already hold at least low-privilege access sufficient to read logs (PR:L), no user interaction is required (UI:N), and standalone Analytics Platform installations not acting as a Server/Hub executor are outside the described scenario. The only complete fix stated by the vendor is upgrading to LTS 5.8.4 or 5.12.0 and later.

This is a genuinely low-to-moderate priority issue, not a high-CVSS scare. The sole supplied CVSS 4.0 vector (4.8, Medium) is internally consistent with the description: AV:L and PR:L mean an attacker must already be a low-privileged local user able to read startup log files, UI:N and AC:L/AT:N mean no victim interaction or special timing once that access exists, and the impact is confined to a subsequent-system confidentiality leak (VC:N/VI:N/VA:N but SC:L) - namely the configured proxy credentials, with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no public exploit identified at time of analysis and no signal of active or automatable exploitation. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the modest CVSS. No CVSS 3.1 vector was supplied, so comparisons are limited to the single 4.0 vector plus the description. The signals do not conflict: a local, authenticated log-read prerequisite plus a credential-disclosure-only impact explains the Medium rating, and the absence of exploitation signals reinforces routine (monthly) patching rather than emergency response.

In a KNIME Server or Business Hub deployment where the Analytics Platform executor is configured with proxy credentials, those credentials are written to the log files at startup. A local user or operator with read access to those executor log files harvests the plaintext proxy username and password and then authenticates to the proxy as the user who configured it. No public exploit code is identified at time of analysis; exploitation is trivial once log-file read access is obtained.