What’s Vulnerable › Vulnerabilities
CVE-2025-14262: Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-08 · updated 2026-10-07
- Weakness: CWE-708
Description
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions. There is no workaround.
Affected products
- KNIME Business Hub: before 1.17.0 — fixed in 1.17.0
How to fix
Upgrade to a fixed version: KNIME Business Hub 1.17.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-14262 or the next vulnerability affects your stack