Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115516— Basic account information visible to unauthenticated user in Business Hub SaaS

Quick assessment

Affected
KNIME KNIME Business Hub SaaS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 KNIME Business Hub SaaS 版本 1.19.0 之前，存在一个授权机制缺陷，导致未授权的远程用户能够获取基础账户信息。此问题无法通过临时变通方案解决。 同样的行为也存在于本地部署的 KNIME Business Hub 安装中，但该行为是出于在隔离的本地环境中促进协作的设计考量。在此场景下，不会泄露任何公司内部尚未知晓的信息。如有需要，可在本地部署版本中通过配置关闭基础账户信息的展示。

CVSS 6.9 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
KNIME KNIME Business Hub SaaS < 1.19.0 affected
1.19.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115516

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Basic account information visible to unauthenticated user in Business Hub SaaS
Source: CVE Program / CVE List V5
Vulnerability Description
An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A workaround is not possible. The same behaviour is present in on-premise KNIME Business Hub installations but it was designed as such in order to foster collaboration in isolated local environments. No information that is not already know within the company is exposed. If required, basic account information can also be turned off via configuration in on-premise installations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
KNIME KNIME Business Hub SaaS 0 ~ 1.19.0 -

II. Public POCs for CVE-2026-115516

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115516

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115516 (1)

Same Patch Batch · KNIME · 2026-10-22 · 7 CVEs total

CVE-2026-115496 6.9 MEDIUM Workflow names may be leaked to unauthenticated users in KNIME Business Hub
CVE-2026-115517 6.4 MEDIUM Unrestricted network access between execution contexts in KNIME Business Hub
CVE-2026-115502 6.3 MEDIUM DataApp links without logging expose job information to other user in KNIME Business Hub
CVE-2026-115454 5.3 MEDIUM Large tables in data apps can bring down execution services in KNIME Hub
CVE-2026-115494 5.3 MEDIUM CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub
CVE-2026-115519 2.1 LOW Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

IV. Related Vulnerabilities

Same vendor: KNIME
Same weakness: CWE-200

V. Comments for CVE-2026-115516

No comments yet

Leave a comment