Business Hub
Monthly
A security vulnerability in KNIME Business Hub (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Open redirect in KNIME Business Hub versions before 1.16.0 lets unauthenticated remote attackers craft links that point at a legitimate Hub installation but bounce the victim's browser to an attacker-chosen destination, enabling phishing or credential-harvesting lures that borrow the trust of the real vendor domain. Exploitation is limited by mandatory user interaction - the victim must click the crafted link (CVSS 4.0 base 5.3, PR:N/UI:P) - and the impact is confined to redirection and low confidentiality loss rather than server compromise or data modification. No public exploit code has been identified at time of analysis, KEV status is not present, and EPSS is only 0.04% (13th percentile), so this is a low-to-moderate priority issue; vendor-released patch: 1.16.0.
KNIME Business Hub deployments running versions prior to 1.16.0 expose the full contents of teammates' jobs - including any sensitive input and output data - to every member of the same team, because job-level authorization was not scoped to the job's creator. The weakness is an incorrect-authorization flaw (CWE-863) that requires an authenticated, low-privilege team member (PR:L) and is further gated by the situational condition that a teammate's job actually contains sensitive data; impact is limited to confidentiality with no integrity or availability effect (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and EPSS is 0.04% (10th percentile), so this is a low-priority, insider-adjacent information-disclosure issue that is fully remediated by upgrading to 1.16.0.
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability in KNIME Business Hub (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Open redirect in KNIME Business Hub versions before 1.16.0 lets unauthenticated remote attackers craft links that point at a legitimate Hub installation but bounce the victim's browser to an attacker-chosen destination, enabling phishing or credential-harvesting lures that borrow the trust of the real vendor domain. Exploitation is limited by mandatory user interaction - the victim must click the crafted link (CVSS 4.0 base 5.3, PR:N/UI:P) - and the impact is confined to redirection and low confidentiality loss rather than server compromise or data modification. No public exploit code has been identified at time of analysis, KEV status is not present, and EPSS is only 0.04% (13th percentile), so this is a low-to-moderate priority issue; vendor-released patch: 1.16.0.
KNIME Business Hub deployments running versions prior to 1.16.0 expose the full contents of teammates' jobs - including any sensitive input and output data - to every member of the same team, because job-level authorization was not scoped to the job's creator. The weakness is an incorrect-authorization flaw (CWE-863) that requires an authenticated, low-privilege team member (PR:L) and is further gated by the situational condition that a teammate's job actually contains sensitive data; impact is limited to confidentiality with no integrity or availability effect (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and EPSS is 0.04% (10th percentile), so this is a low-priority, insider-adjacent information-disclosure issue that is fully remediated by upgrading to 1.16.0.
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.