Authentication Bypass in KNIME Business Hub by KNIME
CVE-2025-2402

8.8HIGH

Key Information:

Vendor

Knime

Status
Knime Business Hub
Vendor
CVE Published:
31 March 2025

What is CVE-2025-2402?

A security vulnerability in KNIME Business Hub arises from a hard-coded password in the object store (MinIO) across all versions except specified updates. This flaw allows unauthenticated attackers to access and modify jobs, as well as retrieve or alter active job data. Additionally, this vulnerability poses a risk of causing a denial-of-service by writing excessive data to the object store. Users are advised to upgrade to versions 1.10.3 or later to mitigate related risks.

Affected Version(s)

KNIME Business Hub 1.13.0 < 1.13.2

KNIME Business Hub 1.12.0 < 1.12.3

KNIME Business Hub 1.11.0 < 1.11.3

References

https://www.knime.com/security/advisories#CVE-2025-2402

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.