CVE-2026-115657— KNIME Analytics Platform logs credentials of configured proxy when used as an executor
Quick assessment
Affected
KNIME KNIME Analytics Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当 KNIME Analytics Platform 长期支持版（LTS）5.8.4 之前的版本在 KNIME Server 或 KNIME Business Hub 中用作执行器时，会在启动过程中将已配置的代理凭据记录到日志中。能够访问日志文件的攻击者可窃取这些凭据，并以配置该代理设置的用户身份使用该代理。此问题已在 LTS 版本 5.8.4 及 5.12.0 和更高版本中得到修复。
Possible ATT&CK Techniques 2 AI
T1003 · OS Credential Dumping T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| KNIME | KNIME Analytics Platform | 5.12.0 |
unaffected |
5.8.4< 5.9.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115657
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KNIME Analytics Platform logs credentials of configured proxy when used as an executor
Source: CVE Program / CVE List V5
Vulnerability Description
When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| KNIME | KNIME Analytics Platform | 5.12.0 | - |
|
II. Public POCs for CVE-2026-115657
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115657
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-115657 (1)
IV. Related Vulnerabilities
Same vendor: KNIME
-
CVE-2026-115519
Sensitive cookies without 'Secure' and 'HttpOnly' attributes -
CVE-2026-115517
Unrestricted network access between execution contexts in KN -
CVE-2026-115502
DataApp links without login expose job information to other -
CVE-2026-115496
Workflow names may be leaked to unauthenticated users in KNI -
CVE-2026-115494
CSRF protection could be tricked by forged X-Forwarded-Host
Same weakness: CWE-532
-
CVE-2026-115885
LangGraph CLI prints the registry push token in `langgraph d -
CVE-2026-54711
PGHoard: Password written to debug log -
CVE-2026-105963
Secret key base exposed in stack trace arguments on wrong-ty -
CVE-2026-115358
OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Ma -
CVE-2026-16648
Mailer Plus Log - Moderately critical - Access bypass - SA-C
V. Comments for CVE-2026-115657
No comments yet