CVE-2026-115496: Workflow names may be leaked to unauthenticated users in KNIME Business Hub
Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hubto a version that resolves this vulnerability.Fixed in 1.18.5
Event History
Frequently Asked Questions
Is an unauthenticated attacker affected by this issue?
No. The available information states that exploitation requires an authenticated remote attacker.
What information does an attacker need to obtain workflow names?
The attacker needs to know the workflow ID. The issue may then disclose the corresponding workflow name through overly informative catalog error messages.
Which deployments should be remediated?
KNIME Business Hub versions prior to 1.18.5 should be remediated. No workaround is available, so upgrading to version 1.18.5 or later is the indicated action.