Read the docs
TI-2026-79324 Aliases CVE-2026-115502GHSA-xwcw-wjgv-8cxr

Missing authorization in KNIME Business Hub DataApp links exposes jobs

Priority LOW 28CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

KNIME Business Hub versions before 1.19.0 are affected. A missing authorization check lets anyone who has a "link without login" for a DataApp list and potentially access jobs of other users created through the same link. The flaw is tracked as CWE-862. An unauthenticated remote attacker with access to such a link can exploit it, and the attack complexity is high.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Fix Fixed KNIME Business Hub (KNIME): 1.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KNIMEKNIME Business Hubbefore 1.19.01.19.0Patch availableCNA
  • KNIME Business Hub VendorKNIME Affected before 1.19.0 Fixed in 1.19.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*——KNIME
  • cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:* Versions — — ·KNIME

Remediation

Upgrade KNIME Business Hub to version 1.19.0 or later. As a workaround until then, remove all "links without login" to DataApps.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA KNIME Business Hub (KNIME) Fixed in 1.19.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    KNIME Business Hub 1.19.0

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-79493 Missing isolation between execution contexts in KNIME Business HubPriority LOW 29
    • TI-2026-79307 Large tables in data apps can bring down execution services in KNIME HubPriority LOW 24
    • TI-2026-79308 CSRF protection bypass in KNIME Business Hub via forged host headerPriority LOW 23
    Show all 5 records →

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115502
  2. 2026-10-22 CISA SSVC decision points changed
  3. 2026-10-22 Priority changed: MEDIUM → LOW
  4. 2026-10-22 Alias added: GHSA-xwcw-wjgv-8cxr
  5. 2026-10-23 Title updated · CNA

References

Other 1

  • TI-2026-79492 Incorrect authorization exposes accounts in KNIME Business Hub SaaS CVSS 4.0MEDIUM 6.9
  • TI-2025-02116 Hard-coded password for object store of KNIME Business Hub CVSS 4.0HIGH 8.8
  • TI-2025-02436 Ingress-nginx vulnerability in KNIME Business Hub CVSS 4.0HIGH 8.7
  • TI-2021-20243 KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. CVSS 3.1HIGH 8.8
  • TI-2026-79312 Error messages leak workflow names to users in KNIME Business Hub CVSS 4.0MEDIUM 6.9
  • TI-2022-22037 Uploading workflows to KNIME Server may override arbitrary file system contents CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences