---
id: "CVE-2026-115657"
kind: "vulnerability"
aliases: ["CVE-2026-115657"]
title: "KNIME Analytics Platform: executor logs proxy credentials at startup, exposing them"
severity: "medium"
cvss: 4.8
epss: 0.00105
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["data-pipelines", "knime", "package", "self-hosted"]
not_affected_if: ["5.8.4-or-later", "no-proxy-credentials"]
published_at: "2026-10-23T09:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:33:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115657", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115657", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# KNIME Analytics Platform: executor logs proxy credentials at startup, exposing them

When KNIME Analytics Platform LTS runs as an executor in KNIME Server or KNIME Business Hub, versions before 5.8.4 write configured proxy credentials to startup logs. Anyone who can read those log files can take the credentials and use the proxy as the user who configured it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the KNIME Analytics Platform LTS version on executors; `5.8.4` or later is not affected by this issue, anything below is.
- Search executor startup logs for proxy configuration entries containing a username or password.

## Fix

- Upgrade KNIME Analytics Platform LTS to `5.8.4`, or to `5.12.0` or later.
- Rotate the proxy credentials that were configured on affected executors, since they may already be in old logs.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115657
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115657

## From the sources

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_