Login Request a demo
High severity · published Mar 26, 2025
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an authenticated user, the severity in the context of KNIME Business Hub is slightly lower. Besides applying the publicly known workarounds, we strongly recommend updating to one of the following versions of KNIME Business Hub: * 1.13.3 or above * 1.12.4 or above * 1.11.4 or above * 1.10.4 or above *
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KB
KNIME Business Hub · KNIME
1.13.0 through 1.13.2; 1.12.0 through 1.12.3; 1.11.0 through 1.11.3; through 1.10.3 · source: vendor
BH
Business Hub · Knime
1.10.0 before 1.10.4; 1.11.0 before 1.11.4; 1.12.0 before 1.12.4; 1.13.0 before 1.13.3 · source: NVD
Affected product
KB
KNIME Business Hub
KNIME
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2787
Mitigation
https://www.knime.com/security-advisory-cve-2025-2787
More from KNIME Business Hub
8.6
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
7.2
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
7.2
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
6.9
CVE-2026-115496
Workflow names may be leaked to unauthenticated users in KNIME Business Hub
6.5
CVE-2024-6598
Denial-of-service on KNIME Business Hub when certain jobs are executed