CVE•Published 2025-12-08•Modified 2026-10-07•0 articles on news•5 live references•NVD data

CVE-2025-14262Knime · Business_hub

Vulnerability data via NVD (ingested)

CVSS v3.1

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS percentile

Exploit Prediction Scoring System · top 93% of all CVEs

Weaknesses (CWE)

CWE-708Incorrect Ownership Assignment

Description

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions. There is no workaround.

Timeline

Published 2025-12-08

Modified 2026-10-07

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2025-14262

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Knime Business Hub"

All exposed Knime Business Hub instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Business Hub"

HTTP body or banner mentions "Business Hub" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2025-14262