CVE-2025-2402 - CVE House
Back to Database
Status published High CVE-2025-2402

Hard-coded password for object store of KNIME Business Hub

Vulnerability Description

A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to cause a denial-of-service of most functionality of KNIME Business Hub by writing large amounts of data to the object store directly. There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub: * 1.13.2 or later * 1.12.3 or later * 1.11.3 or later * 1.10.3 or later

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2402

Credits & Attribution

No credits recorded in the NVD database.

References

More from KNIME

View All →
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
Medium 5.3
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
High 8.7
CVE-2025-14262
Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
Medium 5.3
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
Medium 5.3
CVE-2025-11239
Job details are visible to all team members on KNIME Business Hub
Low 2.3

Affected Vendor

Affected Software

KNIME Business Hub
Vulnerable Versions:
1.13.0, 1.12.0, 1.11.0, 0

Timeline

Official Publish: March 31st, 2025
Last Modified: March 31st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-259

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence