CVE-2025-2402: A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated…

PriorityP351high8.6CVSS 3.1

AVNACLPRNUINSUCLILAH

EPSS

0.38%

30.3th percentile

A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to cause a denial-of-service of most functionality of KNIME Business Hub by writing large amounts of data to the object store directly. There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub: * 1.13.2 or later * 1.12.3 or later * 1.11.3 or later * 1.10.3 or later

Affected

8 ranges

Vendor	Product	Version range	Fixed in
knime	business_hub	< 1.10.3	1.10.3
knime	business_hub	>= 1.11.0 < 1.11.3	1.11.3
knime	business_hub	>= 1.12.0 < 1.12.3	1.12.3
knime	business_hub	>= 1.13.0 < 1.13.2	1.13.2
knime	knime_business_hub	< 1.10.3	1.10.3
knime	knime_business_hub	>= 1.11.0 < 1.11.3	1.11.3
knime	knime_business_hub	>= 1.12.0 < 1.12.3	1.12.3
knime	knime_business_hub	>= 1.13.0 < 1.13.2	1.13.2

CVSS provenance

nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

nvdv4.08.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.