CVE-2026-115657

KNIME Analytics Platform logs credentials of configured proxy when used as an executor

State: Published
Severity: 4.8 Medium
Published: Oct 23, 2026
Updated: Oct 23, 2026
Reserved: Oct 23, 2026

Description

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N	KNIME

Weaknesses

CWE-532 Insertion of sensitive information into log file

Affected Products

Product	Versions
KNIME Analytics PlatformKNIME	5.12.0Not affected 5.8.4 to before 5.9.0Not affected

References

https://www.knime.com/security/advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.