CVE-2025-2402

Hard-coded password for object store of KNIME Business Hub

State: Published
Severity: 8.8 High
Published: Mar 31, 2025
Updated: Mar 31, 2025
Reserved: Mar 17, 2025

Description

A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to cause a denial-of-service of most functionality of KNIME Business Hub by writing large amounts of data to the object store directly.

There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub:

* 1.13.2 or later

* 1.12.3 or later

* 1.11.3 or later

* 1.10.3 or later

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber	KNIME

Weaknesses

CWE-259

Affected Products

Product	Versions
KNIME Business HubKNIME	1.13.0 to before 1.13.2Affected 1.12.0 to before 1.12.3Affected 1.11.0 to before 1.11.3Affected before 1.10.3Affected

References

https://www.knime.com/security/advisories#CVE-2025-2402
https://github.com/advisories/GHSA-v5p7-3387-gpmgthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.