Auth bypass in Apache Artemis allows reading all internal messages
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 11 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-306.
Summary
Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026-27446 https://www.cve.org/CVERecord ). Since KNIME Business Hub uses Apache Artemis it is also affected by the issue. However, since Apache Artemis is not exposed to the outside it requires at least normal user privileges and the ability to execute workflows in an executor. Such a user can install and register a federated mirror without authentication to the original Apache Artemis instance and thereby read all internal messages and inject new messages. The issue affects all versions of KNIME Business Hub. A fixed version of Apache Artemis is shipped with versions 1.18.0, 1.17.4, and 1.16.3. We recommend updating to a fixed version as soon as possible since no workaround is known.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| KNIME | KNIME Business Hub | 1.17.0 to before 1.17.4; 1.16.0 to before 1.16.3; 0.0.0 to before 1.15.2 | 1.17.4, 1.16.3, 1.15.2 | Patch available | CNA |
- KNIME Business Hub VendorKNIME Affected 1.17.0 to before 1.17.4; 1.16.0 to before 1.16.3; 0.0.0 to before 1.15.2 Fixed in 1.17.4, 1.16.3, 1.15.2 Patch available CNA
Remediation
- Fix · CNA KNIME Business Hub (KNIME) Fixed in 1.17.4, 1.16.3, 1.15.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4649
- 2026-10-03 Alias added: GHSA-c27m-9j97-3ghp
References
More KNIME vulnerabilities
- TI-2026-79492 Incorrect authorization exposes accounts in KNIME Business Hub SaaS CVSS 4.0MEDIUM 6.9
- TI-2025-02116 Hard-coded password for object store of KNIME Business Hub CVSS 4.0HIGH 8.8
- TI-2025-02436 Ingress-nginx vulnerability in KNIME Business Hub CVSS 4.0HIGH 8.7
- TI-2021-20243 KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. CVSS 3.1HIGH 8.8
- TI-2026-79312 Error messages leak workflow names to users in KNIME Business Hub CVSS 4.0MEDIUM 6.9
- TI-2022-22037 Uploading workflows to KNIME Server may override arbitrary file system contents CVSS 3.1HIGH 7.5
Sources
- CVE-2026-4649 · CVE Program
- CVE-2026-4649 · NVD
- FIRST EPSS
- GHSA-c27m-9j97-3ghp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-4649 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences