Read the docs
TI-2026-79492 Aliases CVE-2026-115516GHSA-7hpr-2ph3-xp38

Incorrect authorization exposes accounts in KNIME Business Hub SaaS

Priority MEDIUM 46CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

KNIME Business Hub SaaS before 1.19.0 has an incorrect authorization flaw that exposes basic account information (CWE-200). An unauthenticated remote attacker can view this information over the network. The same behaviour is present in on-premise installations, which the vendor designed for collaboration in isolated local environments.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A workaround is not possible. The same behaviour is present in on-premise KNIME Business Hub installations but it was designed as such in order to foster collaboration in isolated local environments. No information that is not already know within the company is exposed. If required, basic account information can also be turned off via configuration in on-premise installations.

Why it matters now

Fix Fixed KNIME Business Hub SaaS (KNIME): 1.19.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KNIMEKNIME Business Hub SaaSbefore 1.19.0; 1.19.01.19.0Patch availableCNA
  • KNIME Business Hub SaaS VendorKNIME Affected before 1.19.0; 1.19.0 Fixed in 1.19.0 Patch available CNA

Remediation

Update KNIME Business Hub SaaS to version 1.19.0, which fixes the issue, as no workaround is possible for the SaaS version. For on-premise installations, basic account information can be turned off via configuration.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA KNIME Business Hub SaaS (KNIME) Fixed in 1.19.0

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115516
  2. 2026-10-22 Alias added: GHSA-7hpr-2ph3-xp38

References

Other 1

  • TI-2025-02116 Hard-coded password for object store of KNIME Business Hub CVSS 4.0HIGH 8.8
  • TI-2025-02436 Ingress-nginx vulnerability in KNIME Business Hub CVSS 4.0HIGH 8.7
  • TI-2021-20243 KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. CVSS 3.1HIGH 8.8
  • TI-2026-79312 Error messages leak workflow names to users in KNIME Business Hub CVSS 4.0MEDIUM 6.9
  • TI-2022-22037 Uploading workflows to KNIME Server may override arbitrary file system contents CVSS 3.1HIGH 7.5
  • TI-2021-20242 KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences