Medium severity · published Oct 22, 2026
CVE-2026-115502
DataApp links without login expose job information to other user in KNIME Business Hub
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KB
KNIME Business Hub · KNIME
before 1.19.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115502
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115502
www.knime.com
https://www.knime.com/security/advisories
More from KNIME Business Hub
8.8
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
8.6
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
7.2
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
7.2
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
6.9
CVE-2026-115496
Workflow names may be leaked to unauthenticated users in KNIME Business Hub