Dashboard / CVE-2026-115657

CVE-2026-115657

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 35/100
Published: 2026-10-23 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: None
VI: None
VA: None

Description

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

Weakness Classification (1)

References & Advisories (1)

Bug Bounty Relevance

35 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

4.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.14%
Raw Score 0.001410
Percentile 3.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00141
2026-10-28
0.00141

Intelligence Sources

nvd ref →

External Links