---
id: CVE-2026-115496
title: Workflow names may be leaked to unauthenticated users in KNIME Business Hub
summary: >-
  Overly informative error messages in the catalog functionality of KNIME
  Business Hub prior to version 1.18.5 may allow an authenticated remote
  attacker to see workflow names if their ID is known. A workaround is not
  possible.
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-209
vendor: KNIME
product: KNIME Business Hub
affected:
  - business_hub < 1.18.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-22T18:32:59.706619Z'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:00:30.950Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115496'
references:
  - url: 'https://www.knime.com/security/advisories'
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.372Z'
---

## Overview

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

## Affected

- `business_hub < 1.18.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.