---
id: "CVE-2026-115496"
kind: "vulnerability"
aliases: ["CVE-2026-115496"]
title: "KNIME Business Hub: verbose catalog errors reveal workflow names to users"
severity: "medium"
cvss: 6.9
epss: 0.00401
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["knime", "knime-business-hub", "other", "self-hosted"]
not_affected_if: ["version-1.18.5-or-later"]
published_at: "2026-10-22T16:17:35+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:38:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115496", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115496", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# KNIME Business Hub: verbose catalog errors reveal workflow names to users

KNIME Business Hub versions before 1.18.5 return overly detailed error messages from the catalog functionality. An authenticated remote attacker who knows a workflow's ID can learn that workflow's name.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed KNIME Business Hub version against `1.18.5`
- unknown

## Fix

- Upgrade KNIME Business Hub to `1.18.5` or later
- The sources say no workaround is possible

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115496
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115496

## From the sources

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_