CVE-2025-11240High· 7.2▾ TwilightAn open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the use…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the attackers choice. This might open the possibility for fishing or other similar attacks. The problem has been fixed in KNIME Business Hub 1.16.0.
business_hub < 1.16.0Upgrade past the affected range:
business_hub 1.16.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11239Medium· 4.3Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team
CVE-2026-115657Medium· 4.8KNIME Analytics Platform logs credentials of configured proxy when used as an executor
CVE-2026-115494Medium· 5.3CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub
CVE-2026-115454Medium· 5.3Large tables in data apps can bring down execution services in KNIME Hub
CVE-2026-115502Medium· 6.3DataApp links without login expose job information to other user in KNIME Business Hub
CVE-2026-115496Medium· 6.9Workflow names may be leaked to unauthenticated users in KNIME Business Hub