CVE-2026-115502 KNIME CVE debrief

Who should care

Defenders and administrators of KNIME Business Hub should assess exposure and prioritize upgrading to version 1.19.0 or later. They should verify exposure of 'links without login' to DataApps, review compensating controls for exposed systems, and track exceptions and remediation efforts. Security teams should also review monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

Defenders should care about CVE-2026-115502 as it allows unauthorized access to job information in KNIME Business Hub via 'links without login', potentially leading to sensitive information disclosure and lateral movement.

• Potential unauthorized access to sensitive job information
• Possible lateral movement within the network
• Need for verification of 'links without login' exposure
• Priority on upgrading to version 1.19.0 or later

Technical summary

The vulnerability exists due to a missing authorization check in KNIME Business Hub, allowing unauthorized access to jobs created by other users via 'links without login' for DataApps. This could lead to sensitive information disclosure and lateral movement. The vulnerability is addressed in version 1.19.0 or later. Defenders should prioritize verifying exposure of 'links without login' to DataApps and upgrading to version 1.19.0 or later. Affected product deployments should be reviewed for exposure, and compensating controls should be considered for exposed systems.

Defensive priority

Defenders should prioritize verifying exposure of 'links without login' to DataApps and upgrading to version 1.19.0 or later.

Recommended defensive actions

• Verify exposure of 'links without login' to DataApps in KNIME Business Hub
• Upgrade to version 1.19.0 or later
• Remove all 'links without login' to DataApps as a workaround
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but vendor-provided advisory details are limited. Evidence is based on CVE Program record, NIST NVD detail page, and source item providing details on the vulnerability. Defenders should verify exposure of 'links without login' to DataApps and prioritize upgrading to version 1.19.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.