What’s Vulnerable › Vulnerabilities

CVE-2026-115496: Workflow names may be leaked to unauthenticated users in KNIME Business Hub

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-22
• Weakness: CWE-209

Description

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

Affected products

• KNIME Business Hub: before 1.18.4 — fixed in 1.18.4

How to fix

Upgrade to a fixed version: KNIME Business Hub 1.18.4. Check the vendor advisory for mitigations.

References

• https://www.knime.com/security/advisories

Get alerted when CVE-2026-115496 or the next vulnerability affects your stack