CVE-2026-115496: KNIME Business Hub Information Disclosure

CVE-2026-115496 Overview

CVE-2026-115496 is an information disclosure vulnerability in the catalog functionality of KNIME Business Hub prior to version 1.18.5. Overly informative error messages reveal workflow names to authenticated remote attackers when a valid workflow ID is known. The flaw is classified under [CWE-209] (Generation of Error Message Containing Sensitive Information). No workaround exists, making the vendor patch the only remediation path. KNIME Business Hub is the on-premises collaboration and deployment platform for KNIME workflows used in enterprise data science environments.

Critical Impact
Authenticated remote attackers can enumerate workflow names across tenants by probing workflow IDs, exposing project metadata that may reveal business operations, naming conventions, or sensitive analytics pipelines.

Affected Products

KNIME Business Hub versions prior to 1.18.5
KNIME Business Hub catalog service component
Deployments exposing the catalog API to authenticated users

Discovery Timeline

2026-10-22 - CVE CVE-2026-115496 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-115496

Vulnerability Analysis

The vulnerability resides in the catalog functionality of KNIME Business Hub. When an authenticated user queries the catalog with a workflow identifier, the service returns an error response that embeds the workflow's name. This behavior leaks metadata that should remain restricted to users with explicit authorization on the target workflow.

The attack requires authentication but no elevated privileges. Any user with a valid session can probe workflow IDs and harvest names from the resulting error responses. Impact is limited to confidentiality of workflow naming metadata, with no modification or availability consequences reported.

Root Cause

The root cause is improper error handling in the catalog service. Error responses include contextual object data, specifically workflow names, instead of returning a generic failure or authorization error. This maps directly to [CWE-209], where diagnostic verbosity exceeds the information the requester is authorized to receive.

Attack Vector

Exploitation occurs over the network against the KNIME Business Hub API. An authenticated attacker sends requests referencing workflow IDs they do not own. The server's error response returns the associated workflow name. ID enumeration or prior knowledge of IDs through logs, URLs, or shared references enables bulk collection of workflow names across the Hub.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this issue. Refer to the KNIME Security Advisories for vendor technical details.

Detection Methods for CVE-2026-115496

Indicators of Compromise

Repeated authenticated requests to catalog endpoints referencing varying or sequential workflow IDs from a single user or session.
Unusual volumes of 4xx error responses from the catalog service correlated with a single account.
API access patterns from accounts that do not normally interact with the catalog service.

Detection Strategies

Enable verbose logging on the KNIME Business Hub catalog service and alert on high-rate access patterns per authenticated principal.
Baseline normal catalog query volume per user role and flag deviations exceeding standard thresholds.
Correlate authentication events with catalog API error responses to identify enumeration behavior.

Monitoring Recommendations

Forward KNIME Business Hub application and reverse proxy logs to a centralized logging platform for retention and search.
Monitor for accounts querying workflow IDs outside their assigned project scope.
Review audit logs for post-login activity that focuses exclusively on catalog endpoints.

How to Mitigate CVE-2026-115496

Immediate Actions Required

Upgrade KNIME Business Hub to version 1.18.5 or later as the only supported remediation.
Audit catalog access logs for enumeration patterns prior to the upgrade.
Review and tighten account provisioning to limit the pool of authenticated users with Hub access.

Patch Information

KNIME has fixed the vulnerability in KNIME Business Hub 1.18.5. Administrators should plan the upgrade according to the vendor's release notes and verify the installed version post-upgrade. See the KNIME Security Advisories for release details and advisory text.

Workarounds

No workaround is available per the vendor advisory; upgrading is required.
Interim risk reduction: restrict Hub access to a minimum set of trusted authenticated users until the patch is applied.
Rotate or revoke accounts suspected of catalog enumeration until logs are reviewed.

bash

# Verify the installed KNIME Business Hub version after upgrade
kubectl -n knime get deploy -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'
# Expected: image tags referencing 1.18.5 or later