Authentication Bypass Vulnerability in Apache Artemis Affecting KNIME Business Hub
CVE-2026-4649

5.3MEDIUM

Key Information:

Vendor

Knime

Status
Knime Business Hub
Vendor
CVE Published:
24 March 2026

What is CVE-2026-4649?

An authentication bypass flaw in Apache Artemis prior to version 2.52.0 allows malicious users with normal privileges to read all messages and inject new messages within the broker. As KNIME Business Hub utilizes Apache Artemis, it remains vulnerable due to the lack of external exposure. Users capable of executing workflows can register a federated mirror without any authentication, leading to potential data breaches. Immediate upgrades are recommended as there are no known workarounds for this vulnerability. Fixed versions include 1.18.0, 1.17.4, and 1.16.3 of the KNIME Business Hub.

Affected Version(s)

KNIME Business Hub 1.17.0 < 1.17.4

KNIME Business Hub 1.16.0 < 1.16.3

KNIME Business Hub 0.0.0 < 1.15.2

References

https://www.knime.com/security/advisories#CVE-2026-4649

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.