All vulnerabilities
CVE-2026-115502

DataApp links without login expose job information to other user in KNIME Business Hub

KNIME KNIME Business Hub
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.19.0Fixed versionCVE List
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.

Text from CVE List

Affected versions 2

  • KNIME Business Hubaffected: all versions before 1.19.0CVE List
  • KNIME Business Hubunaffected: 1.19.0CVE List

References 1