CVE-2026-115657 in Analytics Platform
Summary
by MITRE • 10/23/2026
When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified involves improper credential handling within KNIME Analytics Platform Long Term Support releases prior to version 5.8.4 when deployed as an executor component for either KNIME Server or KNIME Business Hub. The core technical flaw resides in the application's initialization sequence, specifically during the startup phase where proxy configurations are processed. Instead of masking sensitive authentication data such as usernames and passwords associated with configured HTTP proxies, the software logs these values in plaintext within system log files. This behavior constitutes a significant deviation from secure coding practices regarding secret management, leading to the exposure of high-value credentials that grant access to external network resources through the proxy infrastructure.
From an operational perspective, this flaw creates a severe risk vector for unauthorized data exfiltration and lateral movement within enterprise environments. Any individual or automated process with read access to the server's log files can retrieve these plaintext credentials. Once obtained, an attacker can utilize the stolen proxy configuration to route malicious traffic through the organization's approved network channels, effectively bypassing perimeter security controls that trust internal proxy connections. This capability allows adversaries to conduct reconnaissance, exfiltrate sensitive data, or launch attacks against other systems while masking their true origin IP address behind the legitimate proxy identity. The impact is compounded by the fact that log files are often retained for extended periods and may be accessible to a broader range of personnel than just system administrators, including support staff or automated monitoring tools with insufficient access controls.
This vulnerability aligns directly with CWE-532, which defines information exposure through log files as a distinct category of security weakness. The exploitation scenario maps closely to the ATT&CK technique T1078, specifically Valid Accounts and potentially T1046 Network Service Discovery if used for mapping internal assets via the proxy. Furthermore, it relates to CWE-359 regarding exposure of private information in logs. The presence of plaintext credentials in log outputs violates fundamental principles of data confidentiality and secure configuration management recommended by industry standards such as OWASP Application Security Verification Standard section 2.4 on logging errors and security events securely.
Mitigation requires immediate remediation through software updates or strict access control adjustments if upgrading is not immediately feasible. The primary solution is to upgrade KNIME Analytics Platform LTS to version 5.8.4, 5.12.0, or any later release where this logging behavior has been corrected to mask sensitive proxy credentials. In the interim, organizations must enforce rigorous file system permissions on log directories to ensure that only authorized security and administrative personnel have read access. Additionally, implementing log rotation policies with secure deletion mechanisms can reduce the window of exposure for older logs containing these compromised secrets. Security teams should also audit existing log archives for any instances where proxy credentials may have been previously exposed and rotate those specific passwords immediately upon discovery to neutralize potential ongoing threats derived from historical data leaks.