CVE-2026-115502: DataApp links without logging expose job information to other user in KNIME Business Hub
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hubto a version that resolves this vulnerability.Fixed in 1.19.0 - Compensating control
Remove all "links without login" to DataApps.
Event History
Frequently Asked Questions
Who is exposed to this issue?
KNIME Business Hub instances prior to 1.19.0 that have DataApps with “links without login” enabled are exposed. Anyone who has access to one of those links may be able to list and potentially access jobs created by other users through the same link.
What does an attacker need to exploit it?
The attacker needs access to a DataApp “link without login.” No authenticated KNIME Business Hub account is required for access through that link.
What should we do if we cannot update immediately?
Remove all “links without login” to DataApps. This is the stated workaround and prevents use of the affected unauthenticated link mechanism.