Knime
Monthly
KNIME Analytics Platform LTS before 5.8.4, when deployed as an executor in KNIME Server or KNIME Business Hub, writes configured proxy credentials into startup log files, allowing anyone who can read those logs to recover the credentials and use the proxy as the user who configured the proxy settings. Exploitation is local and requires read access to the executor's logs; standalone Analytics Platform installations not acting as a Server/Hub executor are outside the described scenario. The issue is low severity (CVSS 4.0 base score 4.8; assessed CVSS 3.1 local/low with low confidentiality impact), and no public exploit identified at time of analysis.
KNIME Business Hub before 1.19.0 sets sensitive cookies without protective attributes such as Secure, HttpOnly or SameSite, so session data can be read or intercepted only when a separate cross-site scripting flaw exists in the product or an attacker already holds a man-in-the-middle position on the network path. The issue is rated CVSS 4.0 base 2.1 with Attack Requirements set to Present (AT:P), and it is prioritized as monitor; no public exploit was identified at time of analysis and there is no CISA KEV listing. The vendor states that a workaround is not possible and that upgrading to 1.19.0 is the only complete remediation.
KNIME Business Hub deployments before 1.19.0 fail to enforce network compartmentalization between execution contexts, so an authenticated remote user can reach open network ports on executors that belong to a different execution context. By default no ports are open on executors, meaning the exposure exists only where deployed workflows themselves open listening ports and the attacker knows the target executor's IP address, which keeps realistic risk conditional. The issue is fixed in version 1.19.0, a manual network-policy workaround is available, and no public exploit code was identified at time of analysis.
KNIME Business Hub releases prior to 1.19.0 lack an authorization check between users who reach a DataApp through the same 'link without login', letting any holder of that link list - and in some cases access - jobs created by other users through it. The exposure is limited to that per-link job scope rather than the whole Hub, and only exists where an operator has deliberately created and distributed a login-less link; the vendor's documented workaround of removing all such links eliminates the condition entirely. No public exploit code or active exploitation is identified in the available data, and the reported CVSS 4.0 base score is 6.3 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), giving this a moderate, this-month remediation priority rather than an urgent one.
KNIME Business Hub deployments prior to 1.19.0 contain a broken CSRF protection mechanism (CWE-352) that lets an attacker change the state of resources on behalf of a logged-in user without that user noticing. Exploitation requires the victim to have an active, authenticated Hub session and to be lured into passive interaction with attacker-controlled content, after which the browser's forged state-changing request is not rejected; impact is limited to low-integrity modifications with no confidentiality or availability effect. The vendor released a fix in version 1.19.0, and no public exploit code or confirmed active exploitation was identified at time of analysis; the only complete remedy stated by the vendor is upgrading to 1.19.0 or later.
Authenticated users with access to remote workflow editing in KNIME Business Hub before 1.19.0 can exhaust server-side resources, leading to intermittent failure or unavailability of workflow execution. The flaw is availability-only, with no confidentiality or integrity impact, and requires valid credentials with workflow-editing access; no public exploit was identified at time of analysis. KNIME rates it moderate at CVSS 5.3 and states that upgrading to 1.19.0 is the only remediation because no workaround is possible.
Apache Artemis before version 2.52.0 contains an authentication bypass vulnerability (CVE-2026-27446) that allows attackers to read all messages exchanged via the broker and inject new messages. KNIME Business Hub, which embeds Apache Artemis, is affected across all versions, though exploitation requires an authenticated user with workflow execution privileges who can register a federated mirror without authenticating to the underlying Artemis instance. While no public exploit code has been disclosed and CVSS scoring is unavailable, the vulnerability represents a significant insider threat with direct impact on message confidentiality and integrity.
A security vulnerability in KNIME Business Hub (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Analytics Platform LTS before 5.8.4, when deployed as an executor in KNIME Server or KNIME Business Hub, writes configured proxy credentials into startup log files, allowing anyone who can read those logs to recover the credentials and use the proxy as the user who configured the proxy settings. Exploitation is local and requires read access to the executor's logs; standalone Analytics Platform installations not acting as a Server/Hub executor are outside the described scenario. The issue is low severity (CVSS 4.0 base score 4.8; assessed CVSS 3.1 local/low with low confidentiality impact), and no public exploit identified at time of analysis.
KNIME Business Hub before 1.19.0 sets sensitive cookies without protective attributes such as Secure, HttpOnly or SameSite, so session data can be read or intercepted only when a separate cross-site scripting flaw exists in the product or an attacker already holds a man-in-the-middle position on the network path. The issue is rated CVSS 4.0 base 2.1 with Attack Requirements set to Present (AT:P), and it is prioritized as monitor; no public exploit was identified at time of analysis and there is no CISA KEV listing. The vendor states that a workaround is not possible and that upgrading to 1.19.0 is the only complete remediation.
KNIME Business Hub deployments before 1.19.0 fail to enforce network compartmentalization between execution contexts, so an authenticated remote user can reach open network ports on executors that belong to a different execution context. By default no ports are open on executors, meaning the exposure exists only where deployed workflows themselves open listening ports and the attacker knows the target executor's IP address, which keeps realistic risk conditional. The issue is fixed in version 1.19.0, a manual network-policy workaround is available, and no public exploit code was identified at time of analysis.
KNIME Business Hub releases prior to 1.19.0 lack an authorization check between users who reach a DataApp through the same 'link without login', letting any holder of that link list - and in some cases access - jobs created by other users through it. The exposure is limited to that per-link job scope rather than the whole Hub, and only exists where an operator has deliberately created and distributed a login-less link; the vendor's documented workaround of removing all such links eliminates the condition entirely. No public exploit code or active exploitation is identified in the available data, and the reported CVSS 4.0 base score is 6.3 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), giving this a moderate, this-month remediation priority rather than an urgent one.
KNIME Business Hub deployments prior to 1.19.0 contain a broken CSRF protection mechanism (CWE-352) that lets an attacker change the state of resources on behalf of a logged-in user without that user noticing. Exploitation requires the victim to have an active, authenticated Hub session and to be lured into passive interaction with attacker-controlled content, after which the browser's forged state-changing request is not rejected; impact is limited to low-integrity modifications with no confidentiality or availability effect. The vendor released a fix in version 1.19.0, and no public exploit code or confirmed active exploitation was identified at time of analysis; the only complete remedy stated by the vendor is upgrading to 1.19.0 or later.
Authenticated users with access to remote workflow editing in KNIME Business Hub before 1.19.0 can exhaust server-side resources, leading to intermittent failure or unavailability of workflow execution. The flaw is availability-only, with no confidentiality or integrity impact, and requires valid credentials with workflow-editing access; no public exploit was identified at time of analysis. KNIME rates it moderate at CVSS 5.3 and states that upgrading to 1.19.0 is the only remediation because no workaround is possible.
Apache Artemis before version 2.52.0 contains an authentication bypass vulnerability (CVE-2026-27446) that allows attackers to read all messages exchanged via the broker and inject new messages. KNIME Business Hub, which embeds Apache Artemis, is affected across all versions, though exploitation requires an authenticated user with workflow execution privileges who can register a federated mirror without authenticating to the underlying Artemis instance. While no public exploit code has been disclosed and CVSS scoring is unavailable, the vulnerability represents a significant insider threat with direct impact on message confidentiality and integrity.
A security vulnerability in KNIME Business Hub (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.