Is CVE-2026-115657 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115657 being exploited in the wild.

How severe is CVE-2026-115657?

Informational severity, published 23 October 2026.

Which products and versions are affected?

Knime Analytics Platform LTS before 5.8.4, 5.12.0.

Is there a fix for CVE-2026-115657?

Yes: fixed in KNIME Analytics Platform LTS 5.8.4, 5.12.0 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115657 attacked?

It is attacked with local access.

Am I affected by CVE-2026-115657?

Check whether you run Knime Analytics Platform LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115657: KNIME Analytics Platform credential logging in proxy configuration

CVE-2026-115657 · Severity: info · Published 2026-10-23

KNIME Analytics Platform, a data analytics and workflow automation tool, logs proxy credentials in plaintext during startup when used as an executor in KNIME Server or KNIME Business Hub. An attacker with access to server log files can extract these credentials and impersonate the user who configured the proxy, potentially gaining unauthorized network access.

Vendors: Knime.

Quick answers

Is CVE-2026-115657 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115657 being exploited in the wild.
How severe is CVE-2026-115657?: Informational severity, published 23 October 2026.
Which products and versions are affected?: Knime Analytics Platform LTS before 5.8.4, 5.12.0.
Is there a fix for CVE-2026-115657?: Yes: fixed in KNIME Analytics Platform LTS 5.8.4, 5.12.0 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115657 attacked?: It is attacked with local access.
Am I affected by CVE-2026-115657?: Check whether you run Knime Analytics Platform LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: KNIME Analytics Platform LTS 5.8.4, 5.12.0 and later

Technical details

When KNIME Analytics Platform LTS versions before 5.8.4 operate as an executor, configured proxy credentials are written to log files during startup. An attacker with log file access can extract these credentials and use the proxy service with the privileges of the original configuring user. The vulnerability requires log file access but does not require authentication or network interaction beyond that.

Affected products

KNIME Analytics Platform LTS before 5.8.4, 5.12.0

Timeline

2026-10-23: disclosed

References

https://www.knime.com/security/advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.