CVE-2026-115496 PUBLISHED

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

Assigner: KNIME
Reserved: 22.10.2026 Published: 22.10.2026 Updated: 22.10.2026

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	KNIME
Product	KNIME Business Hub
Versions	Default: unaffected affected from 0 to 1.18.4 (excl.) Version 1.18.5 is unaffected

Credits

Zigrin Security finder

References

https://www.knime.com/security/advisories

Problem Types

CWE-209 Generation of error message containing sensitive information CWE

Impacts

CAPEC-54 Query System for Information