CVE-2025-2787: KNIME Business Hub RCE Vulnerability

CVE-2025-2787 Overview

CVE-2025-2787 affects KNIME Business Hub through its dependency on the vulnerable ingress-nginx component referenced by CVE-2025-1974, also known as IngressNightmare. The flaw allows code injection [CWE-94] against the ingress controller running inside the Kubernetes cluster. In the worst case, exploitation can result in complete takeover of the underlying Kubernetes cluster hosting KNIME Business Hub. Because the affected component is only reachable from within the cluster and requires an authenticated user, the practical severity in the KNIME Business Hub context is reduced compared to the upstream advisory.

Critical Impact
An authenticated attacker with internal cluster access can achieve full takeover of the Kubernetes cluster hosting KNIME Business Hub.

Affected Products

KNIME Business Hub versions prior to 1.10.4
KNIME Business Hub versions prior to 1.11.4, 1.12.4, and 1.13.3
Deployments using bundled vulnerable ingress-nginx controllers

Discovery Timeline

2025-03-26 - CVE-2025-2787 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2787

Vulnerability Analysis

KNIME Business Hub ships with the ingress-nginx Kubernetes ingress controller. The IngressNightmare class of issues allows an attacker who can reach the admission controller endpoint to inject NGINX configuration directives. These directives are evaluated by the controller process, leading to arbitrary code execution within the controller pod. The controller pod typically holds privileged service account credentials, so code execution there translates into cluster-wide compromise. In KNIME Business Hub deployments, the controller endpoint is not externally exposed, so an attacker must first obtain authenticated access inside the cluster network.

Root Cause

The root cause is improper neutralization of attacker-controlled input that flows into NGINX configuration generated by the ingress-nginx admission controller [CWE-94]. Crafted AdmissionReview requests can embed directives that the controller writes into its configuration and processes during validation.

Attack Vector

An authenticated user with network reachability to the in-cluster admission webhook submits a malicious admission request containing injected configuration. The controller renders the configuration and executes attacker-controlled logic in the context of the ingress-nginx service account. From there, the attacker can read cluster secrets, escalate privileges, and pivot to other workloads, including KNIME Business Hub services.

No verified public exploit code is referenced in the KNIME advisory. See the KNIME Security Advisory CVE-2025-2787 for vendor technical details.

Detection Methods for CVE-2025-2787

Indicators of Compromise

Unexpected AdmissionReview requests targeting the ingress-nginx admission webhook from non-administrative service accounts.
New or modified NGINX configuration fragments inside ingress-nginx controller pods that were not generated by legitimate Ingress resources.
Outbound network connections from ingress-nginx pods to attacker-controlled hosts.
Use of the ingress-nginx service account token from unexpected pods or nodes.

Detection Strategies

Audit Kubernetes API server logs for admission webhook traffic and correlate calls with the authenticated user or service account identity.
Monitor process execution inside ingress-nginx controller pods for shells, package managers, or interpreters spawned outside normal startup.
Compare rendered nginx.conf against expected templates to identify injected directives.

Monitoring Recommendations

Enable Kubernetes audit logging at the RequestResponse level for admission webhook resources.
Forward controller pod runtime telemetry and Kubernetes audit logs to a centralized analytics platform for correlation.
Alert on privileged API calls performed using the ingress-nginx service account outside expected reconciliation patterns.

How to Mitigate CVE-2025-2787

Immediate Actions Required

Upgrade KNIME Business Hub to a fixed release: 1.13.3 or above, 1.12.4 or above, 1.11.4 or above, or 1.10.4 or above.
Restrict network reachability of the ingress-nginx admission controller to the Kubernetes API server only.
Review and rotate credentials for the ingress-nginx service account if compromise is suspected.
Audit recent admission webhook traffic for anomalous requests prior to patching.

Patch Information

KNIME has released fixed versions of KNIME Business Hub that incorporate a patched ingress-nginx controller. Refer to the KNIME Security Advisory CVE-2025-2787 for upgrade guidance and the corresponding upstream ingress-nginx fix for CVE-2025-1974.

Workarounds

Apply the publicly documented IngressNightmare workarounds for ingress-nginx, including disabling the admission controller if not required.
Enforce NetworkPolicy rules that limit which pods and namespaces can reach the ingress-nginx-controller-admission service.
Tighten Kubernetes RBAC so that only trusted identities can create or update Ingress resources within KNIME Business Hub namespaces.

bash

# Restrict admission webhook reachability via NetworkPolicy
kubectl apply -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-ingress-nginx-admission
  namespace: ingress-nginx
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: TCP
          port: 8443
EOF