CVE-2026-115516: Basic account information visible to unauthenticated user in Business Hub SaaS
An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A workaround is not possible.
The same behaviour is present in on-premise KNIME Business Hub installations but it was designed as such in order to foster collaboration in isolated local environments. No information that is not already know within the company is exposed. If required, basic account information can also be turned off via configuration in on-premise installations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hub SaaSto a version that resolves this vulnerability.Fixed in 1.19.0 - Configuration
Turn off the exposure of basic account information via configuration if required.
KNIME Business Hub on-premise basic account information visibility = off
Event History
Frequently Asked Questions
Which deployments are affected by the unintended exposure?
KNIME Business Hub SaaS deployments before version 1.19.0 are affected. On-premise KNIME Business Hub installations exhibit the same behavior, but it is described as intentional for collaboration in isolated local environments.
Can the exposure be mitigated without updating SaaS?
No workaround is available for the SaaS issue. For on-premise installations, basic account information can be disabled through configuration if required.
What information is exposed, and who can access it?
Basic account information is exposed to unauthorized remote users. The available information indicates that, for on-premise deployments, the exposed details are not information already unknown within the company.