CVE-2026-115502mediumCWE-862

CVE-2026-115502: fallo de gravedad media en KNIME Business Hub

DataApp links without login expose job information to other user in KNIME Business Hub

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear KNIME Business Hub

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.3%
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
KNIME · KNIME Business Hub
CVEs relacionadas — KNIME Business Hub

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-2541MEDIUMSensitive information disclosure in KNIME Hub Web ApplicationEPSS 0.6%CVE-2024-6598HIGHDenial-of-service on KNIME Business Hub when certain jobs are executedEPSS 0.5%CVE-2025-2787HIGHIngress-nginx vulnerability in KNIME Business HubEPSS 0.5%CVE-2026-115517MEDIUMUnrestricted network access between execution contexts in KNIME Business HubEPSS 0.4%CVE-2023-3140MEDIUMKNIME Hub Web Application is vulnerable to clickjackingEPSS 0.4%CVE-2026-115496MEDIUMWorkflow names may be leaked to unauthenticated users in KNIME Business HubEPSS 0.4%