Read the docs
TI-2026-79594 Aliases CVE-2026-115657GHSA-hgpp-4x3f-rrvq

KNIME Analytics Platform logs configured proxy credentials

Priority LOW 21CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

KNIME Analytics Platform LTS versions before 5.8.4 log configured proxy credentials during startup when used as an executor in KNIME Server or KNIME Business Hub. The credentials are written to log files, which is classified as CWE-532. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00141 3rd percentileScored 2026-11-07
Fix Fixed KNIME Analytics Platform (KNIME): 5.12.0, 5.8.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KNIMEKNIME Analytics Platform—5.12.0, 5.8.4Patch availableCNA
  • KNIME Analytics Platform VendorKNIME Affected — Fixed in 5.12.0, 5.8.4 Patch available CNA

Remediation

Update KNIME Analytics Platform to LTS version 5.8.4, or to LTS version 5.12.0 and later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA KNIME Analytics Platform (KNIME) Fixed in 5.12.0, 5.8.4

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115657
  2. 2026-10-23 Alias added: GHSA-hgpp-4x3f-rrvq
  3. 2026-10-23 CISA SSVC decision points changed

References

Other 1

  • TI-2026-79492 Incorrect authorization exposes accounts in KNIME Business Hub SaaS CVSS 4.0MEDIUM 6.9
  • TI-2025-02116 Hard-coded password for object store of KNIME Business Hub CVSS 4.0HIGH 8.8
  • TI-2025-02436 Ingress-nginx vulnerability in KNIME Business Hub CVSS 4.0HIGH 8.7
  • TI-2021-20243 KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. CVSS 3.1HIGH 8.8
  • TI-2026-79312 Error messages leak workflow names to users in KNIME Business Hub CVSS 4.0MEDIUM 6.9
  • TI-2022-22037 Uploading workflows to KNIME Server may override arbitrary file system contents CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences