CVE-2026-115516: CWE-200 in KNIME KNIME Business Hub SaaS
Description
CVE-2026-115516 is an authorization vulnerability in KNIME Business Hub SaaS versions before 1.19.0 that exposes basic account information to unauthorized remote users. The issue is due to incorrect authorization checks. On-premise installations exhibit similar behavior by design to support collaboration within isolated environments, with options to disable basic account info exposure via configuration. No workaround exists for the SaaS version. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.
CVSS v4.0
Score 6.9medium
Affected software
KNIME
KNIME Business Hub SaaS
pkg:github/knime/knime-business-hub-saasRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-115516 describes an incorrect authorization vulnerability (CWE-200) in KNIME Business Hub SaaS prior to version 1.19.0. This flaw allows unauthorized remote users to access basic account information. The on-premise version shares this behavior intentionally to facilitate collaboration in isolated local environments, exposing only information already known within the company. The SaaS version does not have a workaround. Basic account information exposure can be disabled via configuration in on-premise deployments. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No known exploits are reported in the wild. The vendor has not provided explicit patch or remediation links, but version 1.19.0 is indicated as the fixed version.
Potential Impact
Unauthorized remote users can access basic account information in KNIME Business Hub SaaS versions before 1.19.0 due to incorrect authorization. This exposure is limited to basic account details and does not include sensitive or confidential information. On-premise installations expose similar information by design but restrict exposure to internal company knowledge. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Upgrade KNIME Business Hub SaaS to version 1.19.0 or later to remediate this vulnerability. No workaround is available for the SaaS version. For on-premise installations, if exposure of basic account information is a concern, it can be disabled via configuration settings. Review and apply the vendor's official guidance for version 1.19.0 to ensure proper remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- KNIME
- Date Reserved
- 2026-10-22T17:33:47.977Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada4f7b4d27ba8daa6dce35
Added to database: 10/22/2026, 18:01:31 UTC
Last enriched: 10/22/2026, 18:15:26 UTC
Last updated: 10/22/2026, 18:16:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.