{"id":"CVE-2026-115657","kind":"vulnerability","aliases":["CVE-2026-115657"],"related":[],"title":"KNIME Analytics Platform: executor logs proxy credentials at startup, exposing them","description":"When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.","summary":"When KNIME Analytics Platform LTS runs as an executor in KNIME Server or KNIME Business Hub, versions before 5.8.4 write configured proxy credentials to startup logs. Anyone who can read those log files can take the credentials and use the proxy as the user who configured it.","severity":"medium","cvss":4.8,"epss":0.00105,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-pipelines","knime","package","self-hosted"],"not_affected_if":["5.8.4-or-later","no-proxy-credentials"],"how_to_check":"- Check the KNIME Analytics Platform LTS version on executors; `5.8.4` or later is not affected by this issue, anything below is.\n- Search executor startup logs for proxy configuration entries containing a username or password.","fix":"- Upgrade KNIME Analytics Platform LTS to `5.8.4`, or to `5.12.0` or later.\n- Rotate the proxy credentials that were configured on affected executors, since they may already be in old logs.","status":"open","published_at":"2026-10-23T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:33:01+00:00","updated_at":"2026-10-25T04:33:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:33:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade KNIME Analytics Platform LTS to `5.8.4`, or to `5.12.0` or later.\n- Rotate the proxy credentials that were configured on affected executors, since they may already be in old logs.","reach":"local","title":"KNIME Analytics Platform: executor logs proxy credentials at startup, exposing them","impact":"medium","summary":"When KNIME Analytics Platform LTS runs as an executor in KNIME Server or KNIME Business Hub, versions before 5.8.4 write configured proxy credentials to startup logs. Anyone who can read those log files can take the credentials and use the proxy as the user who configured it.","category":"package","nicknames":[],"who_cares":["knime","self-hosted","data-pipelines"],"confidence":0.6,"needs_auth":"yes","worst_case":"Proxy credentials readable from logs, enabling use of the proxy as the configuring user","analyst_note":"","how_to_check":"- Check the KNIME Analytics Platform LTS version on executors; `5.8.4` or later is not affected by this issue, anything below is.\n- Search executor startup logs for proxy configuration entries containing a username or password.","needs_analyst":false,"not_affected_if":["no-proxy-credentials","5.8.4-or-later"],"who_is_affected":"Teams running KNIME Analytics Platform LTS as an executor under KNIME Server or KNIME Business Hub that have authenticated proxy settings configured. Exposure depends on who can read executor log files. Installations without proxy credentials, or with executors on 5.8.4 or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3393,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115657':13A,16A '-2026':12A,15A '5.12.0':131C '5.8.4':43B,90C,129C 'access':101C 'analyt':2A,27B,85C 'anyon':51B 'attack':99C 'busi':39B,82C 'configur':45B,70B,92C,117C 'credenti':7A,47B,61B,93C,108C 'cve':11A,14A 'data':18B 'data-pipelin':17B 'either':77C 'executor':4A,33B,75C 'expos':10A 'file':57B,104C 'fix':125C 'host':24B 'hub':40B,83C 'issu':122C 'knime':1A,20B,26B,35B,38B,78C,81C,84C 'later':133C 'log':5A,50B,56B,91C,103C 'lts':29B,87C,127C 'packag':21B 'pipelin':19B 'platform':3A,28B,86C 'proxi':6A,46B,65B,95C,112C,119C 'read':54B 'run':30B 'self':23B 'self-host':22B 'server':36B,79C 'set':120C 'startup':9A,49B,97C 'steal':106C 'take':59B 'use':63B,72C,110C 'user':68B,115C 'version':41B,88C,128C 'write':44B","nicknames":[],"mitigations":[],"who_affected":"Teams running KNIME Analytics Platform LTS as an executor under KNIME Server or KNIME Business Hub that have authenticated proxy settings configured. Exposure depends on who can read executor log files. Installations without proxy credentials, or with executors on 5.8.4 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@knime.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115657","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115657","severity":null,"published_at":"2026-10-23T09:17:06+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115657","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115657","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}