CVE-2026-115517 KNIME CVE debrief

Who should care

Defenders responsible for KNIME Business Hub deployments, especially those with manually opened network ports, should assess exposure and prioritize verifying the necessity of network policies.

Why it matters

Defenders should prioritize verifying exposure in KNIME Business Hub deployments, especially those with manually opened network ports, and assess the necessity of network policies to restrict access.

• Authenticated remote users may access open network ports on executors in different execution contexts
• Potential for lateral movement within the network if IP addresses of executors are known
• Need for manual network policy creation as a workaround

Technical summary

The vulnerability in KNIME Business Hub before version 1.19.0 allows authenticated remote users to access open network ports on executors in different execution contexts if the IP address of the attacked executor is known and there are open network ports that provide access without further authentication. This issue poses a security risk if network ports are manually opened. Defenders should prioritize verifying exposure in KNIME Business Hub deployments, especially those with manually opened network ports, and assess the necessity of network policies to restrict access.

Defensive priority

Defenders should prioritize verifying exposure in KNIME Business Hub deployments, especially those with manually opened network ports, and assess the necessity of network policies.

Recommended defensive actions

• Verify KNIME Business Hub version and upgrade to 1.19.0 or later if necessary
• Review and implement network policies to restrict access to open network ports
• Monitor workflow configurations and port usage to identify potential attack surfaces
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in KNIME Business Hub before version 1.19.0, which allows authenticated remote users to access open network ports on executors in different execution contexts if the IP address of the attacked executor is known.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.